Executive brief
Gestao X Business Suite is an integrated business management platform used to centralize company operations, handle customer service, automate workflows, and manage projects across departments. A reflected cross-site scripting (XSS) vulnerability in the image configuration endpoint allows authenticated attackers to inject malicious JavaScript code, which executes in victims' browsers when they click malicious links. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.
Technical details
A reflected XSS vulnerability exists in the /Configuracao/Imagens.aspx endpoint due to insufficient validation and sanitization of the mensagem parameter. The vulnerability is triggered when an authenticated attacker crafts a malicious URL containing JavaScript payload in the mensagem parameter; the application reflects this unsanitized input directly into the browser response. No additional preconditions beyond authentication are required for exploitation. An attacker can inject arbitrary JavaScript code that executes in the context of a victim's browser, potentially leading to session hijacking, credential theft, or unauthorized administrative actions. This vulnerability affects versions 8.4 and earlier; patch availability has not been disclosed.
Affected products
- EMX Tecnologia Gestao X Business Suite 8.4 and earlier
Timeline
- 2026-09-04: disclosed