CVE-2026-111284 in Aureus ERP
Summary
by MITRE • 10/16/2026
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads that execute when HR managers or administrators open the Holiday modal, hijacking their sessions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Aureus ERP versions up to 1.6.0 represents a significant security flaw classified as Stored Cross-Site Scripting, commonly referred to in industry standards under CWE-79: Improper Neutralization of Input During Web Page Generation. This specific weakness resides in the HolidayAction.php component of the application's backend logic. The core technical issue stems from the improper handling and rendering of user-supplied input data. Specifically, when an authenticated user provides a name for a Public Holiday or Mandatory Day, the system accepts this string without adequate sanitization or encoding before storing it in the database. Subsequently, when this stored value is retrieved and rendered within the web interface, particularly inside the Holiday modal dialog, it is processed as an HtmlString object rather than being treated as plain text. This failure to escape special HTML characters allows embedded JavaScript code to be interpreted by the victim's browser as executable script rather than static content.
The operational impact of this vulnerability is severe due to its stored nature and the privilege level required for exploitation. Unlike reflected XSS, where an attacker must trick a user into clicking a malicious link, this flaw persists in the application's data store. Any authenticated user with permissions to create or manage Public Holidays can inject persistent payloads. When HR managers, administrators, or other authorized personnel access the Holiday modal to view details of these entries, their browsers automatically execute the injected scripts. This execution occurs within the security context of the victim's session, granting the attacker the ability to hijack active sessions. By stealing sensitive cookies, authentication tokens, or session identifiers, an attacker can impersonate legitimate users without needing valid credentials for those accounts.
Beyond simple session hijacking, this vulnerability enables a broader range of malicious activities consistent with ATT&CK technique T1059: Command and Scripting Interpreter. An attacker could use the injected script to perform actions on behalf of the victim, such as modifying system configurations, exfiltrating sensitive employee data stored within the ERP system, or defacing the user interface. The ability to execute arbitrary JavaScript effectively bypasses same-origin policy protections because the malicious code runs from a trusted domain—the Aureus ERP application itself—making it difficult for browser-based security mechanisms to detect and block the activity automatically. This poses a critical risk to data integrity and confidentiality within enterprise environments relying on this software for human resources management.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves modifying the HolidayAction.php file to ensure that all user-supplied input is properly encoded before being rendered in HTML contexts. Developers should implement strict output encoding, such as using functions like htmlspecialchars with appropriate flags, to convert special characters into their corresponding HTML entities, thereby preventing them from being interpreted as executable code. Additionally, implementing a Content Security Policy (CSP) header can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, limiting the impact even if input validation fails. Regular security audits and static application security testing should be integrated into the development lifecycle to detect such encoding flaws early. Users running affected versions should upgrade to a patched release immediately or apply manual code patches as advised by the vendor until an official update is available.