Executive brief
Auktion NG is an online auction software platform used by auction websites. A reflected cross-site scripting (XSS) vulnerability in the password reset page allows attackers to inject malicious code that executes in visitors' browsers, potentially leading to account takeover, phishing attacks, or data theft through session hijacking.
Technical details
A reflected XSS vulnerability exists in the /forgotpasswd.html endpoint where the email parameter is not properly HTML-encoded before being reflected in the value attribute of an input tag. An attacker can break out of the attribute context by injecting unencoded double quotes and event handlers (e.g., onpointerenter) to execute arbitrary JavaScript in the victim's browser under the trusted origin. The vulnerability requires user interaction (hovering over or interacting with the input field) and is exploited via a crafted link or form submission.
Affected products
- onSite internet GmbH Auktion NG up to 20260722
Timeline
- 2026-07-22: disclosed: Vulnerability tested and reported
- 2026-09-23: advisory: Published as CVE-2026-96258