Helpdesk EUVD-2026-23908

Exploitation requires an authenticated staff member account with access to the Troubleshooter module's step creation or editing functionality. The attacker must successfully submit a POST request to Controller_Step.InsertSubmit() or EditSubmit() with a malicious payload in the subject parameter, and this payload must be stored in the backend database. The victim must then navigate to Troubleshooter > View Troubleshooter and click on the injected step link for the JavaScript to execute. The vulnerability is not limited to specific configurations or deployment modes - it affects all installations of GFI HelpDesk before version 4.99.9 where the Troubleshooter module is enabled and accessible. No special protocol or feature flags are required. The primary limiting factor is the requirement for valid staff credentials and victim user interaction; unauthenticated remote exploitation is not possible, and the payload only executes when the victim explicitly clicks the step link, not on automatic page load.

The CVSS score of 5.1 reflects a moderate severity assessment driven by the requirement for authenticated access (PR:L) and user interaction (UI:P - the victim must click the affected step link). However, the real-world risk is context-dependent. CVSS attack vector (AV:N) confirms network-based exploitation is possible. The confidentiality impact is None (VC:N), but scope is changed (S:X context suggests potential scope escalation), with slight integrity impact (SI:L), making this a stored XSS that could facilitate account compromise, credential theft, or privilege escalation if the executing JavaScript harvests session tokens or admin actions. The authentication requirement is a significant limiting factor - only staff members can inject payloads, reducing attacker pool to trusted insiders or compromised staff accounts. User interaction requirement (clicking the step link) further constrains exploitation but is routinely satisfied in Troubleshooter workflows. No public exploit code or CISA KEV status is indicated in the provided data, suggesting this is not yet actively exploited at scale, though the straightforward nature of XSS injection and the availability of a public advisory via VulnCheck increases the probability of weaponization post-disclosure. Given the availability of a vendor patch, organizations running pre-4.99.9 versions should prioritize updating to eliminate the vulnerability entirely.

An authenticated staff member or insider with Troubleshooter module access crafts a malicious JavaScript payload (e.g., code to steal session cookies or redirect to a phishing page) and injects it into a new or existing troubleshooter step subject field via the POST request to Controller_Step.InsertSubmit(). The payload is stored server-side without sanitization. When any user (including administrators or other staff) navigates to Troubleshooter > View Troubleshooter and clicks the affected step link, View_Step.RenderViewSteps() renders the unsanitized subject into the HTML page, and the JavaScript executes in the user's browser with the privileges of the logged-in user. The attacker could then harvest session tokens, steal credentials entered into forms, or trigger malicious actions on behalf of the victim.