CVE-2025-61427

Vulnerability

Overview

The login component of BEO Atlas Einfuhr – Ausfuhr 3.0 is vulnerable to reflected cross-site scripting (XSS). The userid and password parameters are reflected in the server response without proper escaping or validation, allowing an attacker to inject arbitrary JavaScript code [1].

Exploitation

Scenario

An attacker crafts a malicious URL containing a JavaScript payload in the userid or password parameter. When a victim clicks the link (e.g., via email or chat), the browser loads the login page and executes the injected script in the context of the application [1]. No authentication is required; the attacker only needs to lure the victim into visiting the crafted URL.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the victim's browser. This could lead to session cookie theft, page content manipulation, or further payload delivery, compromising the user's account and data [1].

Mitigation

The vendor (BEO GmbH) confirmed the vulnerability and released a patch on August 19, 2025. Users should update to the latest version (build/20250328 or later) as specified in the vendor release notes [1].