Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-27T17:18:58.570Z",
  "pubdate": "2026-08-27T17:18:58.570Z",
  "executiveSummary": "BilPark Informatics Technologies Industry and Trade Inc. DoXBASE contains an Improper Neutralization of Input During Web Page Generation vulnerability, commonly classified as Cross-Site Scripting (XSS).\nThis vulnerability allows an unauthenticated or authenticated attacker to inject arbitrary malicious scripts into web pages viewed by other users within the application.\nThe flaw affects DoXBASE versions up to and including 27082026.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the victim, theft of session cookies, sensitive information disclosure, or the redirection of users to malicious external sites.\nThe impact is significant as it undermines the integrity and confidentiality of user sessions and client-side data.\nThe vendor has been unresponsive to disclosure efforts, leaving installations exposed without an official security patch.\nRisk mitigation is highly recommended through manual implementation of input sanitization and output encoding controls.",
  "technicalDetails": "The vulnerability resides within the application's input processing logic, which fails to adequately sanitize or encode user-supplied data before rendering it in the browser's Document Object Model (DOM).\nThe application acts as a conduit for malicious scripts, allowing an attacker to craft a payload—typically JavaScript—that is stored or reflected by the web server.\nIn a standard attack flow, the attacker identifies an input vector that is subsequently echoed back to the user without proper contextual output encoding (e.g., HTML entity encoding, JavaScript escaping, or URL encoding).\nUpon injecting a script tag or event handler (such as 'onload' or 'onerror'), the attacker delivers a link or triggers a request containing the payload to the victim.\nWhen the victim's browser processes the response from the DoXBASE server, the injected script is executed within the security context of the victim's session.\nBecause the payload executes in the browser, it can access document cookies, bypass Same-Origin Policy (SOP) constraints, or interact with sensitive application data that the user is authorized to view.\nThe vulnerability is pervasive across versions up to 27082026, suggesting a fundamental lack of secure coding practices regarding input validation and output encoding in the application's view-layer rendering engine.\nSince the vendor has not provided a patch, the attack surface remains exposed on all versions within the specified range.\nExploitation does not necessarily require deep knowledge of the server-side infrastructure; rather, it requires sufficient understanding of the application's input fields to ensure the payload is accepted and subsequently rendered without modification.\nThe post-exploitation impact includes the potential for session hijacking, where the attacker steals session tokens to perform unauthorized administrative or user-level actions.\nFurthermore, the attacker can leverage the XSS to perform Cross-Site Request Forgery (CSRF) or modify the visual content of the page, potentially leading to phishing or the forced execution of unauthorized transactions within the DoXBASE ecosystem."
}