CVE-2025-1810

Vulnerability

Description A reflected cross-site scripting (XSS) vulnerability has been identified in Pixsoft Vivaz versions prior to 6.0.11. The issue affects the login endpoint at /servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231&sistema=0. The sistema parameter is not properly sanitized, allowing an attacker to inject arbitrary HTML and JavaScript code into the response page [1][2]. The vendor was contacted but did not respond [1].

Exploitation

This is a reflected XSS vulnerability that can be exploited remotely without authentication. An attacker can craft a malicious URL containing a payload in the sistema parameter, such as "><img%20src%20onerror=alert()>. When a victim clicks on the crafted link, the injected script executes in the context of their browser session on the affected application [2]. The proof-of-concept demonstrates that the injection is successful when the alert box appears [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser. This can be used to steal session cookies, redirect the user to malicious sites, perform actions on behalf of the user, or deface the application page. The attack does not require any authentication, making it easier to target any user who visits the specially crafted link [1][2].

Mitigation

As of the published date, no official patch or vendor advisory has been issued. The vendor did not respond to the disclosure [1]. Organizations running Pixsoft Vivaz versions below 6.0.11 should consider applying input validation and output encoding on the sistema parameter as a workaround, or restrict access to the affected endpoint until a patch is released.