Management summary
The WebOrderSystem by VertiGIS is affected by multiple cross-site scripting (XSS) vulnerabilities. This allows an attacker to execute malicious JavaScript code in the victim's browser. The vendor did not communicate a patch for the identified vulnerabilities in VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the fixes. Version numbers were not provided nor when the fixes were implemented. A workaround exists for CVE-2026-4952, which should be applied while no official fix is available. Contact the vendor for further information regarding fixes or hardening measures.
Vendor description
"VertiGIS creates industry-leading technology that advances spatial visibility into assets – across industries and across the globe. Our intuitive range of use-case-based tools can help you solve complex business challenges, leverage spatial data in new ways and build solutions that make a difference."
Source: https://www.vertigis.com/
Business recommendation
The vendor did not communicate a patch for the identified vulnerabilities in VertiGIS "WebOrderSystem" and told us that "LM Explorer" will incorporate the fixes. Version numbers were not provided nor when the fixes were implemented.
A workaround exists for CVE-2026-4952, which should be applied while no official fix is available. Contact the vendor for further information regarding fixes or hardening measures.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged users to manage the employees (users) of defined companies (user groups). An authenticated attacker with access to the CustomerAdministration portal can insert malicious JavaScript code in a user's properties while editing the user. The inserted code will be executed if other privileged users visit either the user entry directly or the user overview of the specific user group.
2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
The VertiGIS CustomerAdministration portal (KundenManager) allows privileged users to search for employees (users) across all defined companies (user groups). The search parameter "searchValue" can be embedded in the URL, so that if a privileged user that is currently logged into the CustomerAdministration portal visits that URL, the search will be performed. An unauthenticated attacker with knowledge about the URL structure can craft a URL containing malicious JavaScript code in the "searchValue" parameter. The inserted code will be executed if the target privileged user visits the crafted URL while already being logged into the CustomerAdministration portal.
3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
The VertiGIS "ASMobile" web interface, which is part of the software package "GIS Portal", allows authenticated users to define a business reference. An attacker can insert malicious JavaScript code inside the business reference. Initially this issue affects the "ASMobile" web interface as what is considered a "self-xss". However, when placing orders through the web interface, the malicious business reference will be included in the order details and will later be shown in the OrderAdministration portal (AuftragsManager). The inserted JavaScript code will be executed if a high privileged user with access to the OrderAdministration portal visits the order that contains the attacker's malicious business reference.
Proof of concept
1) Stored Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4950)
When editing an existing user of a user group through the CustomerAdministration portal, the following request, including malicious JavaScript code in the "secondName" parameter, can be sent when saving the changes:
[ PoC removed ]After saving the changes, the JavaScript code will be executed immediately after the editing page, as can be seen in figure 1 below:
Figure 1: Stored XSS in CustomerAdministration portal
Figure 2 below shows that the JavaScript code will also be executed when a user visits the user overview of the edited user's user group:
Figure 2: Stored XSS in user overview
2) Reflected Cross-Site Scripting in VertiGIS CustomerAdministration Portal (CVE-2026-4951)
An unauthenticated attacker with knowledge about the CustomerAdministration portal's URL structure can craft the following URL, which contains malicious JavaScript code in the "searchValue" parameter:
[ PoC removed ]When a privileged user, who is currently logged into the CustomerAdministration portal, visits the crafted URL, the included JavaScript code will be executed, as can be seen in figure 3 below:
Figure 3: Reflected XSS in CustomerAdministration portal
Potential further impacts may arise from the fact that administrative users can change other user's (including other administrators) passwords without specifying the old password. An attacker may be able to craft a URL loading a remote script that performs a password reset, allowing to either take over specific accounts or lock out other users entirely from the application.
3) Stored Cross-Site Scripting in VertiGIS OrderAdministration Portal (CVE-2026-4952)
A user's business reference can be edited by the user through the "ASMobile" web interface, when being logged in. For demonstration purposes, an image HTML tag can be inserted in the reference, which, when causing an error, executes a JavaScript alert. When adding such a payload to the business reference and exiting the text field, the JavaScript alert will be executed, as can be seen in figure 4 below:
Figure 4: Stored XSS in business reference
Rechecking the business reference after exiting the alert shows that the malicious image tag was rendered inside the page, as shown in figure 5 below:
Figure 5: Malicious image tag was rendered inside the page
When placing orders through the web interface, the user's business reference will also be included. After the order is placed, it will be listed in the administrative OrderAdministration portal and the malicious JavaScript code will be executed in a high privileged browser of the victim, when it visits that order.
Vulnerable / tested versions
The following version has been tested which was the latest version available at the time of the test:
- WebOrderSystem (7.0.8.6)
Different software components, including WebOrderSystem, GIS Portal and multiple 3A Web components, were installed on the tested system. The vulnerabilities were associated with the WebOrderSystem.
The vendor did not provide further information which exact products or versions are affected.