-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID:               SYSS-2026-073  
Product:                   ICO.Fraud
Manufacturer:              ICO-LUX GmbH
Affected Version(s):       Up to 1.39
Tested Version(s):         1.39
Vulnerability Type:        Cross-Site Scripting (CWE-79)
Risk Level:                High
Solution Status:           Fixed
Manufacturer Notification: 2026-08-03
Solution Date:             2026-09-04
Public Disclosure:         2026-09-30
CVE Reference:             Not yet assigned
Author of Advisory:        Mara Lehmann, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

ICO.Fraud is an application that checks whether submitted service 
invoices are forged.

The manufacturer describes the product as follows (see [1]):

"With ICO.Fraud, ICO-LUX has an innovative product for fraud defence 
and document authentication. With ICO.Fraud, forged documents are 
recognised fully automatically and in real time - thanks to smart 
vision technology and cognitive automation."

Due to insufficient input validation, ICO.Fraud allows persistent 
cross-site scripting (PXSS).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

It was identified that ICO.Fraud is vulnerable to PXSS attacks.

The web application allows checking and, e.g., commenting on ongoing 
reviews of documents. These comments can be inserted as text. The 
vulnerability was discovered writing a document note.

An authenticated user can insert JavaScript code in a comment field, 
and the injected code will be interpreted and executed in the context 
of other users as soon as the document with the corresponding comment
is displayed. 

This kind of attack could allow attackers to perform actions in the 
context of the targeted user. As a result, the attacker could steal 
session information, manipulate content, or even exploit the victim's
system.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

A malicious user logs in to the application and navigates to the
following page: https://<DOMAIN>/feedback_dashboard.php. Then, the
user adds an <img> tag as document feedback that contains JavaScript
code. A possible payload proving JavaScript execution is as follows:
    
  <img src=0 onerror=prompt(document.domain)>

Another authenticated user can navigate to VP-History 
(https://<DOMAIN>/hist_verspers.php?id=...) and search the ID of the 
insuranced person or writer. After opening the file, the embedded 
JavaScript code is executed and the prompt displays the domain.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

To mitigate the vulnerability, the software should be updated to 
version 1.40.1.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2026-07-31: Vulnerability discovered
2026-08-03: Vulnerability reported to manufacturer
2026-09-04: Patch released by manufacturer
2026-09-30: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for ICO.Fraud
    https://www.ico-lux.de/en/products/icofraud
[2] SySS Security Advisory SYSS-2026-073
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-073.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/responsible-disclosure-policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Mara Lehmann of SySS GmbH.

E-Mail: mara.lehmann@syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Mara_Lehmann.asc
Key ID: 0x647E0C15652F519B
Key Fingerprint: 8B28 87EE E3F8 7EF1 DC2F D92F 647E 0C15 652F 519B

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS website.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSLKIfu4/h+8dwv2S9kfgwVZS9RmwUCarys7AAKCRBkfgwVZS9R
mxfcAP9g2CDXDVMM9P9At4dl3K9PLHvjZw7fIwHlw4nAvusKFAD9Fss3XSIuYEyc
q0/tPgHzH566b8p8Qdr52CQFlIx6jwA=
=prws
-----END PGP SIGNATURE-----