Executive brief
SVXportal, a management portal for radio systems, contains a security flaw in its user registration process. An attacker can submit malicious code during registration that will later run in the web browser of a system administrator. This could allow an attacker to hijack administrative sessions, modify system settings, or gain unauthorized access to the management interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in SVXportal version 2.5 and earlier. The vulnerability is located in the user registration workflow where 'index.php' submits data to 'admin/user_action.php'. User-provided input in fields such as 'Firstname', 'lastname', and 'email' is stored in the backend database without sufficient output encoding. When an administrator accesses 'admin/users.php' to manage accounts, the malicious payload is rendered and executed in the context of the administrator's browser session. This allows for session hijacking or unauthorized administrative actions. The vulnerability can be exploited by an unauthenticated remote attacker.
Affected products
- sa2blv SVXportal <= 2.5
Timeline
- 2026-02-20: disclosed
- 2026-02-20: advisory