| Título | Webkul Bagisto <=2.4.4 Cross Site Scripting |
|---|
| Descripción | Bagisto 2.4.4 contains a stored cross-site scripting vulnerability in RMA conversation messages. A normal authenticated frontend customer can inject malicious HTML or JavaScript into an RMA message and have it execute later when the message is viewed in frontend and backend RMA views.
The affected flow uses POST /customer/account/rma/send-message to submit an RMA conversation message. The frontend applies client-side sanitization before sending the request, but this can be bypassed by intercepting and modifying the request. The server validates the message only as a string and stores the raw value. Later, both the frontend RMA view and the backend admin RMA view render the stored message through v-html, causing attacker-controlled HTML to be inserted into the DOM.
The impact is stored XSS across trust boundaries. A customer can persist script content in RMA conversation history, and the payload can execute when viewed by the same customer, other users with access to the conversation, or backend administrators reviewing the RMA. In an admin context, successful exploitation may allow theft of sensitive page data, session-related abuse depending on browser protections, or privileged actions performed through the administrator's authenticated session.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| Fuente | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/39_english_vulnerability_report.md |
|---|
| Usuario | Mitch45 (UID 99299) |
|---|
| Sumisión | 2026-06-26 06:46 (hace 2 meses) |
|---|
| Moderación | 2026-08-16 20:05 (2 months later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 391196 [Webkul Bagisto hasta 2.4.4 RMA Message send-message Mensaje secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|