Description

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:16:57.560Z",
  "pubdate": "2026-08-13T14:16:57.560Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Business Directory product affecting versions 6.4.25 and prior. This security flaw enables remote, unauthenticated threat actors to inject arbitrary client-side scripts, such as malicious JavaScript, into web pages rendered to other users visiting the application. The primary impact of this vulnerability includes session hijacking, credential theft, redirection to malicious destinations, and unauthorized actions performed within the context of the victim's browser session. Because the vulnerability requires no authentication and can be exploited over the network, it poses significant risk to confidentiality, integrity, and availability of the affected web application users. Exploitation relies on the application failing to properly sanitize or encode user-supplied input before reflecting or storing it in the Document Object Model (DOM). Successful exploitation requires a victim to interact with the malicious payload or navigate to the compromised application page, whereupon the injected script executes within the security context of the victim's browser, bypassing standard same-origin policy boundaries established for malicious domains.",
  "technicalDetails": "The vulnerability resides within the input handling and output rendering mechanisms of the Business Directory product for versions <= 6.4.25. The root cause is improper neutralization of user-supplied data during web page generation, allowing raw HTML and JavaScript payloads to be injected without prior sanitization, contextual encoding, or validation. The affected component processes HTTP requests containing parameters that are subsequently rendered back to users or stored within the backend database without adequate defensive controls. Attack vectors involve an unauthenticated attacker crafting a malicious HTTP request or payload vector containing arbitrary script tags or event handlers (e.g., onerror, onload) designed to execute within the victim browser's execution context. The attack flow commences when the attacker crafts the malicious input string. This payload is transmitted over the network to the vulnerable endpoint within the Business Directory application. Due to the lack of strict input filtering and output encoding, the application integrates the malicious payload into the HTTP response. Upon receipt, the victim's browser parses the HTML document and executes the embedded script due to the absence of robust Content Security Policy (CSP) headers or proper entity encoding. Post-exploitation impact heavily depends on the privileges of the victim interacting with the injected content; if an administrative user evaluates the malicious payload, the attacker can achieve full administrative compromise of the application frontend, create new administrative accounts, or execute arbitrary actions on behalf of the administrator. The vulnerability exhibits network exposure via HTTP/HTTPS protocols, requires zero authentication credentials, and demands no privileged access levels to initiate the attack sequence."
}