Executive brief
ARD GEC en ligne, a meal reservation service used by schools, hospitals, and businesses, contains a security flaw in its transaction confirmation page. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login cookies, session hijacking, or unauthorized actions performed on the user's behalf.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in the ARD meal reservation service (GEC en ligne) within the 'transactionID' GET parameter on the transaction confirmation page. The application fails to properly validate input and encode output for this parameter, allowing an unauthenticated remote attacker to inject malicious scripts. Exploitation requires a victim to interact with a specially crafted URL (User Interaction required). Successful exploitation can result in the execution of arbitrary JavaScript in the context of the victim's session, potentially leading to session cookie theft (CWE-79). A proof-of-concept payload has been publicly disclosed.
Affected products
- ARD GEC en ligne -
Timeline
- 2025-09-22: disclosed: Initial disclosure of CVE-2025-55887
- 2025-09-22: advisory: NVD publication date