CVE-2021-45225

Vulnerability

In COINS Construction Cloud 11.12, several URL parameters in the search window (querySortOrder, queryFilterType) and activity view window (pvCILevel, pvCISibling, TopMenu) are not properly neutralized before being included in the generated HTML page [1]. This allows an attacker to inject arbitrary JavaScript by adding URL-encoded quotation marks (%22) to break out of HTML attribute context; activity view parameters also incorporate user input into JavaScript, enabling a second injection type undetectable by HTML tag filters [1].

Exploitation

An attacker needs only to craft a malicious link containing the XSS payload in one of the affected parameters and convince an authenticated user to click it (no special network position required beyond connectivity to the COINS application) [1]. No additional privileges or user interaction beyond clicking the link are needed because the injected script executes in the victim's browser session within the application's security context.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, leading to potential session hijacking, credential theft, defacement, or redirection to malicious sites [1][2]. Because the application is also vulnerable to account takeover via other flaws, an attacker could escalate privileges even from a low-privileged account [2].

Mitigation

The manufacturer was notified on 2021-11-02, but as of the public disclosure date (2022-01-13) no fix had been provided and the solution status remained "Open" [1]. No workaround is described in the available references [1][2]. Users should monitor the vendor for a patched version or consider implementing a web application firewall to filter malicious parameters as a temporary measure.