CVE-2024-10090: Softcom.wroc Iksoris XSS Vulnerability

CVE-2024-10090 Overview

CVE-2024-10090 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Internet Starter module of the SoftCOM iKSORIS system. The iKSORIS platform is a ticket reservation and sales system used primarily in the Polish market. An attacker can craft a malicious form used for adding users, then trick an authenticated victim into submitting it. The injected script executes in the victim's browser context, allowing session data theft, forced actions, or content manipulation within the iKSORIS application. The vendor patched the flaw in version 79.0. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
A successful attack allows script execution in the victim's browser context, enabling theft of session material and unauthorized actions against the iKSORIS user management interface.

Affected Products

SoftCOM iKSORIS Internet Starter module (all versions prior to 79.0)
iKSORIS ticket reservation and sales system deployments exposing the affected user-add form
SoftCOM (softcom.wroc) iksoris component as identified in the CPE record cpe:2.3:a:softcom.wroc:iksoris:*:*:*:*:*:*:*:*

Discovery Timeline

2025-04-14 - CVE-2024-10090 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10090

Vulnerability Analysis

The Internet Starter module of iKSORIS fails to neutralize user-controlled input reflected back in HTTP responses. Specifically, a form intended for adding users renders attacker-supplied data without contextual output encoding. When a victim submits a crafted request, the server echoes the payload into the response, and the browser parses it as executable script. Because the attack targets an authenticated administrative workflow, the injected script runs with the privileges of the current session. This enables theft of session cookies, forgery of privileged requests against the user management interface, and manipulation of rendered content. The Exploit Prediction Scoring System (EPSS) data indicates a low current probability of observed exploitation.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The Internet Starter user-add form accepts request parameters and reflects them into the HTML response without applying HTML entity encoding or a context-aware output filter. No Content Security Policy is enforced to constrain inline script execution.

Attack Vector

Exploitation requires user interaction. The attacker constructs a URL or HTML form containing a JavaScript payload targeting the vulnerable user-add endpoint. The attacker then delivers the link through phishing, chat, or an embedded resource on a page the victim visits. When the authenticated iKSORIS user loads or submits the crafted form, the reflected payload executes in their session context.

No verified exploit code is publicly available. See the CERT Poland advisory for coordinated disclosure details covering related iKSORIS issues.

Detection Methods for CVE-2024-10090

Indicators of Compromise

HTTP requests to iKSORIS Internet Starter user-add endpoints containing script tags, javascript: URIs, or event-handler attributes such as onerror= and onload= in query or form parameters
Server access logs showing reflected parameter values that include encoded angle brackets (%3C, %3E) or percent-encoded script fragments
Referer headers pointing to untrusted external domains preceding administrative form submissions

Detection Strategies

Deploy a web application firewall rule set that inspects request parameters targeting the Internet Starter module for XSS payload signatures
Correlate authenticated session activity with unusual outbound requests to unknown domains that could indicate cookie exfiltration
Review application logs for HTTP 200 responses that echo request parameters verbatim in the response body

Monitoring Recommendations

Enable verbose HTTP request and response logging on iKSORIS front-end servers and forward events to a centralized analytics platform
Alert on administrative account sessions that generate anomalous DOM manipulation or form submissions outside of normal working hours
Monitor browser telemetry from operator workstations for script execution originating from the iKSORIS domain that references external URLs

How to Mitigate CVE-2024-10090

Immediate Actions Required

Upgrade the iKSORIS Internet Starter module to version 79.0 or later, which contains the vendor fix
Restrict access to the iKSORIS administrative interface to trusted networks and VPN users only
Instruct administrators and operators to avoid clicking iKSORIS links delivered through email, chat, or external sites until patching is verified

Patch Information

SoftCOM addressed the vulnerability in Internet Starter version 79.0. Operators of iKSORIS deployments should coordinate with SoftCOM support to obtain the patched module and confirm version parity across all production nodes. Consult the CERT Poland advisory and the iKSORIS product page for vendor references.

Workarounds

Enforce a strict Content Security Policy on the iKSORIS front-end that disables inline scripts and restricts script sources to the application origin
Place the iKSORIS interface behind a web application firewall with reflected XSS signatures enabled for the user-add endpoint
Require administrators to use dedicated browsers or isolated browsing sessions when accessing iKSORIS management functions

bash

# Example CSP header to reduce reflected XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'