EUVD-2025-209047CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL en 'site' parameter in 'app_login.php'.
Analysis
GDTaller is vulnerable to reflected cross-site scripting (XSS) in the app_login.php file, specifically through the 'site' parameter, allowing unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via malicious URLs. The vulnerability affects GDTaller versions prior to an unspecified patch release and carries a CVSS 5.1 score reflecting low immediate confidentiality impact but limited scope and user interaction requirement. A vendor patch is available from INCIBE, though no public exploit code has been identified at time of analysis.
Technical Context
This vulnerability is a classic reflected XSS flaw (CWE-79) in PHP-based web application input handling. The app_login.php endpoint fails to properly sanitize or encode user-supplied input in the 'site' parameter before reflecting it back to the client in HTTP responses. GDTaller (cpe:2.3:a:gdtaller:gdtaller) is a PHP web application, and the lack of context-appropriate output encoding allows attacker-controlled script payloads to be parsed and executed by the victim's browser within the security context of the vulnerable domain. Reflected XSS differs from stored XSS in that the payload must be delivered in the request itself; the server does not persistently store it.
Affected Products
GDTaller all versions prior to the patched release are affected, as indicated by the CPE cpe:2.3:a:gdtaller:gdtaller:*:*:*:*:*:*:*:* and the EUVD advisory stating 'GDTaller 0 <*'. The vendor advisory from INCIBE (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller) contains the authoritative list of vulnerable versions and patch availability details. Additional information is available in the NVD vulnerability entry at https://nvd.nist.gov/vuln/detail/CVE-2025-41026.
Remediation
Upgrade GDTaller to the patched version released by the vendor via INCIBE's security advisory. The patch is confirmed available per vendor notification. Until patching is completed, implement input validation and output encoding mitigations: enforce strict Content Security Policy (CSP) headers to prevent inline script execution, apply HTML entity encoding to all user-supplied input reflected in responses, and consider deploying a Web Application Firewall (WAF) with XSS signature rules to block malicious payloads in the 'site' parameter. Additionally, educate end users to avoid clicking links from untrusted sources, and monitor access logs for suspicious 'site' parameter values containing script tags or JavaScript protocols. Consult https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller for exact patched version numbers and deployment instructions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today