EUVD-2025-209049CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_recuperarclave.php'.
Analysis
GDTaller allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers through reflected cross-site scripting (XSS) via the 'site' parameter in app_recuperarclave.php. The vulnerability affects all versions of GDTaller (version 0 and beyond) and has been assigned a CVSS 4.0 base score of 5.1 with limited scope impact. A vendor patch is available from INCIBE, and exploitation requires user interaction (UI:A) but presents moderate risk due to the network-accessible attack surface and low technical complexity.
Technical Context
GDTaller is a PHP-based application (identified via CPE cpe:2.3:a:gdtaller:gdtaller) vulnerable to CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The vulnerability exists in the password recovery endpoint (app_recuperarclave.php), which fails to properly sanitize the 'site' parameter before reflecting it in HTTP responses. This is a classic reflected XSS flaw where user-supplied input is directly incorporated into the HTML/JavaScript context without encoding or validation, allowing attackers to inject malicious script payloads that execute in the security context of the victim's browser session.
Affected Products
GDTaller versions prior to the patched release are affected, as confirmed by CPE cpe:2.3:a:gdtaller:gdtaller:*:*:*:*:*:*:*:* and the EUVD advisory stating 'GDTaller 0 <*' (indicating all versions from 0 onwards). The vulnerability was reported by INCIBE (Spanish National Cybersecurity Institute) and a patch is available from the vendor; further details on the patched version number and upgrade path are provided in the INCIBE security notice at https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller and the NVD detailed advisory at https://nvd.nist.gov/vuln/detail/CVE-2025-41027.
Remediation
Upgrade GDTaller to the patched version released by the vendor as documented in the INCIBE security notice (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gdtaller). Until patching is completed, implement input validation and output encoding on the 'site' parameter in app_recuperarclave.php to neutralize script injection attempts; specifically, ensure all user input is HTML-encoded before reflection in HTTP responses and consider implementing Content-Security-Policy (CSP) headers to restrict inline script execution. Additionally, restrict access to the password-recovery endpoint via network controls if feasible, and educate users not to click links in unsolicited emails or messages directing them to this endpoint with suspicious query parameters.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today