Majid Lakhnati

The create user function in the baltic-it TOPqw Webportal is vulnerable to SQL injection. This issue affects the `/Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser` endpoint, where the `username` variable in the JSON object allows the manipulation of SQL queries.

The login form of the baltic-it TOPqw Webportal at "/Apps/TOPqw/Login.aspx" is vulnerable to SQL injection. The vulnerability exists in the `txtUsername` parameter, which allows for manipulation of SQL queries.

The issue is related to Incorrect Access Control in the User Management function, specifically in the /Apps/TOPqw/BenutzerManagement.aspx endpoint. This allows a low-privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock other users or unlock their own account, change the password of other users, create new users or delete existing users, and view, manipulate, and delete reference data.

The issue affects the "Stammdaten" menu in the /Apps/TOPqw/qwStammdaten.aspx endpoint, allowing for persistent Cross-Site Scripting (XSS).

The issue concerns a Cross-Site Scripting (XSS) vulnerability in the file upload function of the "QWKalkulation" tool. To exploit this vulnerability, an attacker must be authenticated to the application using the "TOPqw Webportal". Once authenticated, the attacker can persistently place malicious JavaScript code in the "QWKalkulation" menu. The vulnerable endpoint is /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx.