Submit #972881: Webkul Aureus ERP v1.6.0 Cross Site Scripting
| Titel | Webkul Aureus ERP v1.6.0 Cross Site Scripting |
|---|---|
| Beschreibung | A stored Cross-Site Scripting (XSS) vulnerability exists in the Payment Term note field of AureusERP v1.6.0. The Payment Term REST API accepts arbitrary HTML/JavaScript in the note parameter without performing server-side sanitization, as the field is validated only as a nullable string. The stored value is subsequently rendered by the Filament admin panel using HtmlString, causing the application to output the content as raw HTML without sanitization. Although the TipTap-based admin interface does not normally allow direct <script> injection because its editor representation escapes such content, an authenticated user with permission to update Payment Terms can bypass this client-side restriction by submitting a crafted payload directly to the REST API. Once stored, the payload executes in the browser of any user who subsequently views the affected Payment Term record, including administrators. Because the JavaScript executes within the application's origin and the victim's authenticated browser session, it may perform actions and access data permitted to the victim's account, making this a persistent stored XSS vulnerability. Researchers Information Researcher - 1 Name: Karan Parelkar Independent Security Researcher Email: [email protected] GitHub: https://github.com/KaranParelkar LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/ Researcher - 2 Name: Devansh Sanghvi Independent Security Researcher Email: [email protected] GitHub: https://github.com/Devansh10845 LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
| Quelle | ⚠️ https:/ |
| Benutzer | KaranParelkar (UID 99714) |
| Einreichung | 11.09.2026 10:47 (vor 1 Monat) |
| Moderieren | 11.10.2026 15:57 (1 month later) |
| Status | Duplikat |
| VulDB Eintrag | 407321 [Webkul Aureus ERP bis 1.6.0 Accounting Plugin Payment Term note Cross Site Scripting] |
| Punkte | 0 |