XSS in ICTBroadcast Demo Environment via login.php

Executive Summary

CVE-2026-7190 is a reflected Cross-Site Scripting (XSS) vulnerability in ICTBroadcast software's demo environment. It occurs in the 'login.php' endpoint where the 'editForm[extension_username]' parameter is reflected in the response without proper filtering. Attackers can inject malicious JavaScript code via a crafted URL, which executes in the victim's browser when accessed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the login.php endpoint for the 'editForm[extension_username]' parameter in HTTP responses. Use tools like curl to send a test request with a payload such as 'editForm[extension_username]=test<script>alert(1)</script>' and check if the script is reflected without sanitization. Example command: curl 'http://target/login.php?editForm[extension_username]=test<script>alert(1)</script>'

Additionally, use browser developer tools to monitor network requests and responses for the login.php endpoint. Look for unsanitized input in the 'editForm[extension_username]' parameter.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in your browser if you click a malicious link. This could lead to session hijacking, theft of cookies or sensitive data, defacement of web pages, or redirection to phishing sites. It primarily affects users accessing the vulnerable ICTBroadcast demo environment.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest security patch from ICT Innovations, which was released in March 2026. Update the ICTBroadcast software to the patched version to fix the XSS flaw in the login.php endpoint.

Implement input validation and output encoding for the 'editForm[extension_username]' parameter. Use frameworks or libraries that automatically sanitize user input to prevent XSS attacks.

Useful 0 Not Useful 0