A cross-site scripting vulnerability in Beyaz Computer's CityPLus software allows for unauthorized script execution, potentially leading to session hijacking or data theft.

This is an improper neutralization of input during web page generation (CWE-79), commonly known as Cross-Site Scripting (XSS). An attacker can supply malicious input that is rendered in the victim's browser, executing in the context of the user's session.

Exploitation of this XSS vulnerability can lead to unauthorized access to user sessions, data theft, or the redirection of users to malicious sites. While the CVSS score of 7.6 reflects a high severity, the impact is primarily focused on the client-side session and data integrity, potentially damaging user trust and organizational reputation.

Immediate Action: Upgrade to version V24.29750.1.0 or later as provided by the vendor.

Proactive Monitoring: Review web application access logs for unusual patterns in URL parameters or input fields that may indicate script injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block common XSS payloads in incoming HTTP requests.

Public Exploit Available: No

Users of the CityPLus platform must apply the vendor-provided update immediately to neutralize this XSS vector. Organizations should prioritize input validation and sanitization reviews to prevent similar vulnerabilities in future software deployments.