CVE-2023-5989 in LioXERP
Summary
by MITRE • 12/21/2023
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uyumsoft Information System and Technologies' LioXERP allows an authenticated user to execute Stored XSS.
This issue affects LioXERP: before v.146.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability identified as CVE-2023-5989 represents a critical cross-site scripting flaw within the Uyumsoft Information System and Technologies LioXERP platform, specifically impacting versions prior to 146. This stored XSS vulnerability arises from inadequate input sanitization during web page generation processes, creating a persistent security risk that can be exploited by attackers to inject malicious scripts into the application's user interface. The flaw manifests when user-supplied data is not properly escaped or validated before being rendered in web pages, allowing attackers to store malicious code that executes in the context of other users' browsers.
The technical implementation of this vulnerability stems from the application's failure to adequately neutralize user input within HTML content generation mechanisms. When legitimate users interact with the LioXERP interface and provide input that gets stored in the system's database, the application does not properly sanitize this data before subsequent rendering. This creates a persistent vector where malicious scripts can be stored and executed whenever other users view the affected content. The vulnerability falls under CWE-79 which specifically addresses Cross-Site Scripting flaws in web applications, where insufficient input validation and output encoding creates opportunities for attackers to inject malicious code. The stored nature of this vulnerability means that the malicious payload persists in the application's database and can affect multiple users over time, amplifying the potential impact beyond a single session.
The operational impact of this vulnerability extends far beyond simple data theft or defacement, as it provides attackers with the ability to hijack user sessions, steal sensitive information, and potentially escalate privileges within the application. An attacker who successfully exploits this vulnerability can execute arbitrary JavaScript code in the victim's browser, potentially leading to session hijacking, credential theft, or redirection to malicious sites. The stored nature of the attack means that the vulnerability can remain active for extended periods, affecting all users who encounter the malicious content without proper input validation. This vulnerability particularly impacts organizations using LioXERP for business process management, as it could compromise sensitive business data, financial information, and operational processes that rely on the platform's integrity.
Mitigation strategies for CVE-2023-5989 should focus on implementing comprehensive input validation and output encoding mechanisms within the LioXERP application. Organizations should immediately upgrade to version 146 or later, which contains the necessary patches to address the stored XSS vulnerability. Additionally, implementing proper content security policies, employing strict input sanitization routines, and utilizing secure coding practices that escape all user-supplied content before rendering can significantly reduce the risk of exploitation. The remediation process should include thorough code reviews to identify all potential input vectors and ensure that proper encoding is applied to all dynamic content generation. This vulnerability also aligns with ATT&CK technique T1531 which describes the use of cross-site scripting to compromise user sessions and access sensitive data within web applications. Organizations should implement regular security testing including dynamic application security testing and manual penetration testing to identify similar vulnerabilities in their web applications and ensure that input validation mechanisms are properly enforced throughout the application lifecycle.