Automotive Dealer Portal in SAP R/3 Enterprise Application (versions: 600 602 603 604 605 606 616 617) does not sufficiently encode user-controlled inputs this makes it possible for an attacker to send unwanted scripts to the browser of the victim using unwanted input and execute malicious code there resulting in Cross-Site Scripting (XSS) vulnerability.