Executive brief
Intermark IT's WebControl CMS, a platform used for managing website content, contains a security flaw in its contact form processing. An attacker can use this flaw to send emails that appear to come from the website but contain malicious HTML code. This could be used to mislead users or conduct phishing attacks against staff or customers who receive these automated emails.
Technical details
An HTML injection vulnerability exists in Intermark IT's WebControl CMS v3.5 within the '/processContact.do' endpoint. The application fails to properly sanitize input from the 'nombreApellidos', 'dirección', and 'comentarios' parameters before including them in generated emails. A remote, unauthenticated attacker can exploit this by submitting a specially crafted request to the contact form, resulting in the delivery of an email containing arbitrary HTML to the intended recipient. This is classified as CWE-79 (Cross-site Scripting) due to the improper neutralization of input during web page or content generation. As of the advisory date, no patch has been reported.
Affected products
- Intermark IT WebControl CMS 3.5
Timeline
- 2026-06-29: advisory: Initial disclosure by INCIBE-CERT
- 2026-06-30: disclosed: CVE published to NVD dataset