CVE-2016-5660

Vulnerability

The iframeid parameter in AttachmentsList.aspx of Accela Civic Platform Citizen Access portal is vulnerable to cross-site scripting (XSS) [1]. An attacker can inject arbitrary web script or HTML via this parameter, which is not properly sanitized. The vulnerability is classified as CWE-79 [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by crafting a malicious URL with a iframeid parameter containing JavaScript payload. When a victim accesses this URL, the script executes in the context of the victim's browser session [1]. No user interaction beyond clicking the link is required.

Impact

Successful exploitation allows the attacker to execute arbitrary script in the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information accessible in the portal context [1].

Mitigation

As of the publication date, the vendor (Accela) indicated that a fix was being produced, but no patch or version information is available [1]. Users are advised to contact their Accela customer support representative for updates [1]. No workaround is provided.