Description

A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-04T05:16:26.010Z",
  "pubdate": "2026-10-04T05:16:26.010Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified within the Ticket Attachment Upload functionality of the Omega Solution CoinEx Crypto 2025 platform.\nThe vulnerability resides in the file /user/ticket, allowing remote attackers to inject malicious scripts into the application environment.\nSuccessful exploitation permits the execution of arbitrary JavaScript within the context of a victim's session, potentially leading to unauthorized actions, session hijacking, or sensitive data exfiltration.\nThe vulnerability is publicly disclosed, increasing the risk of active exploitation.\nAs the product is reportedly retired and the vendor is unresponsive, there is no official security patch available, leaving deployed instances at perpetual risk.\nAttackers do not require deep authentication protocols if the file path is publicly accessible, facilitating remote exploitation without significant barriers.",
  "technicalDetails": "The vulnerability is a classic Cross-Site Scripting (XSS) flaw located within the Ticket Attachment Upload feature of the /user/ticket component.\nThe root cause of this vulnerability is improper input validation and insufficient sanitization of user-supplied data during the file upload or processing phase. When a user submits an attachment or related metadata via the /user/ticket interface, the application fails to adequately sanitize or encode the content before rendering it back in the browser.\nThe attack flow initiates when an attacker crafts a malicious payload containing an executable script—typically JavaScript—and injects it into the upload field or metadata associated with the ticket attachment. Because the application logic does not neutralize these scripts, they are stored and subsequently rendered in the victim's or an administrator's browser session upon viewing the ticket.\nExploitation is conducted remotely. An attacker can leverage the publicly available exploit code to craft requests that bypass the intended security controls. By manipulating the HTTP request parameters sent to /user/ticket, the attacker forces the application to reflect the malicious payload directly into the Document Object Model (DOM) of the page.\nOnce the payload is executed in the user's browser, the impact is significant. The script runs under the origin of the Omega Solution CoinEx domain, granting the attacker access to session cookies, sensitive local storage items, and the ability to perform actions on behalf of the authenticated user. This includes modifying ticket data, harvesting credentials, or redirecting users to malicious external domains.\nThe vulnerability is persistent, as the injected script is stored within the application's ticketing database. This ensures that the attack remains active each time a user accesses the affected ticket, creating a long-term risk for any user interacting with the compromised system.\nGiven that the vendor is unresponsive and the product is no longer maintained, the vulnerability is unpatched, rendering manual intervention by system administrators necessary to prevent exploitation."
}