The vulnerability allows an authenticated user to insert arbitrary JavaScript into the business reference field of the ASMobile web interface. When such a value is stored in an order, the code is rendered unescaped in the OrderAdministration portal (AuftragsManager). A privileged user who opens the order page will then execute the script in their browser context, potentially enabling the attacker to hijack the privileged session, steal credentials, or modify order data. The issue is a classic stored XSS (CWE‑79), offering impact on confidentiality, integrity, and availability of the privileged accounts involved.

Affected is VertiGIS Ltd. WebOrderSystem (AuftragsManager) version 7.0.8.6, the latest tested release. No additional versions were confirmed, though the vendor has not identified a broader affected range. The vulnerability exists in the ASMobile component of the VertiGIS GIS Portal and is embedded in orders placed through that interface.

The CVSS score of 5.1 indicates a medium severity, primarily because the flaw requires authenticated access to the business reference field. The EPSS score is not available, and the vulnerability is currently not listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. Attackers would need to log into the system, create or modify an order with malicious JavaScript, and wait until a privileged user opens the order in the administrative portal to trigger the payload. The attack vector is therefore internal and reliant on user interaction by an admin.