Executive brief
Saysis StarCities, a municipal or urban management software platform, contains a security vulnerability that could allow an attacker to execute malicious scripts in a user's browser. By tricking an authorized user into clicking a specially crafted link, an attacker could potentially steal session information or perform unauthorized actions on behalf of that user. This could lead to unauthorized access to city management data or administrative functions.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Saysis Computer Systems StarCities before version 1.1.61. The application fails to properly neutralize user-supplied input during web page generation, allowing an attacker to inject malicious scripts. Exploitation requires a low-privileged attacker to trick a victim into interacting with a malicious link (User Interaction required). Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized data modification. The vulnerability is addressed in version 1.1.61.
Affected products
- Saysis Computer Systems Trade Ltd. Co. StarCities before 1.1.61
Timeline
- 2025-11-19: advisory: Initial advisory published by TR-CERT/USOM