PT-2025-16230 · Softcom · Softcom Iksoris Internet Starter

Paweł Zdunek · Published 2025-04-14 · Updated 2025-10-28 · CVE-2024-13598

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: SoftCOM iKSORIS Internet Starter versions prior to 79.0

Description: The issue is related to Reflected XSS (Cross-site Scripting) attacks. It occurs when a user creates new form fields, which can introduce new parameters vulnerable to XSS attacks. If a user is tricked into filling such a form with a malicious script, the code will be executed in their context.

Recommendations: For versions prior to 79.0, update to version 79.0 to resolve the issue. As a temporary workaround, consider restricting the use of the functionality that allows creating new form fields to minimize the risk of exploitation. Avoid using this functionality until the issue is resolved by updating to the patched version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-13598

Affected Products

Softcom Iksoris Internet Starter

References · 8

• https://osv.dev/vulnerability/CVE-2024-13598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13598 · Security Note
• https://t.me/cveNotify/140718 · Telegram Post
• https://t.me/cvetracker/21523 · Telegram Post
• https://t.me/cvedetector/22857 · Telegram Post
• https://iksoris.pl/system-rezerwacji-i-sprzedazy-biletow-iksoris.html · Note
• https://cert.pl/en/posts/2025/04/CVE-2024-10087 · Note
• https://twitter.com/CVEnew/status/1911767833861628312 · Twitter Post