HTML Injection in Intermark IT WebControl CMS

Executive Summary

CVE-2026-6953 is an HTML injection vulnerability found in Intermark IT's WebControl CMS version 3.5. This vulnerability allows an attacker to send an email containing malicious HTML code to a victim by exploiting the contact form.

To exploit this vulnerability, the attacker must send a specially crafted request using the 'nombreApellidos', 'dirección', and 'comentarios' parameters to the '/processContact.do' endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to inject harmful HTML content into emails sent via the contact form, potentially leading to further attacks such as phishing or the execution of malicious scripts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring requests to the '/processContact.do' endpoint that include the parameters 'nombreApellidos', 'dirección', and 'comentarios' containing suspicious or malicious HTML code.

You can use network monitoring tools or web server logs to identify such requests.

• Use grep or similar command-line tools to search web server logs for requests to '/processContact.do' with the relevant parameters, for example:
• grep "/processContact.do" /var/log/apache2/access.log | grep -E "nombreApellidos=|dirección=|comentarios="
• Use intrusion detection systems (IDS) or web application firewalls (WAF) to detect and alert on HTML injection patterns in these parameters.

Useful 0 Not Useful 0

Mitigation Strategies

Since no solution or patch has been reported at this time, immediate mitigation steps include:

• Implement input validation and sanitization on the server side to filter out malicious HTML code in the 'nombreApellidos', 'dirección', and 'comentarios' parameters.
• Restrict or monitor access to the '/processContact.do' endpoint to detect and block suspicious requests.
• Use a web application firewall (WAF) to block or alert on HTML injection attempts.
• Educate users to be cautious of unexpected emails that may contain malicious HTML content.

Useful 0 Not Useful 0