| Título | Webkul aureuserp 1.5.0 Cross Site Scripting |
|---|
| Descripción | A stored cross-site scripting (XSS) vulnerability exists in the Chatter activity-log feature of aureuserp/aureuserp (commit 8409fde) due to unsafe rendering of user-controlled input in the Filament view `content-text-entry.blade.php`. When a tracked field on a model (e.g. a Project's `Name`) is edited, `HasLogActivity::logModelActivity()` stores the field's old and new values verbatim, with no HTML sanitization, in the Chatter message's `properties` column. The Blade view then outputs those `old_value`/`new_value` diffs using Blade's unescaped syntax (`{!! !!}`), allowing arbitrary HTML and JavaScript to be injected and persisted. Any authenticated user able to edit a tracked field on any of 18 affected models (Projects, Tasks, Sales/Purchase Orders, Leaves, Manufacturing Orders, Payments, and more) can store a malicious payload that executes in the browser of any user — including a higher-privileged admin — who later opens that record's Chatter feed, potentially leading to session/credential compromise, unauthorized actions performed in the victim's context, and data exfiltration from the application panel.
Steps to reproduce:
1. Log in to the AureusERP admin panel as any authenticated user with permission to create/edit a Project (`/admin/project/projects`).
2. Create a new project with any placeholder name (e.g. "Test Project") and save it.
3. Open the project and click "Edit".
4. Replace the ""Name" field's value with a payload such as:
`<img src=x onerror=alert("XSS")>`
5. Click "Save changes". This triggers `HasLogActivity::logModelActivity('updated')`, which logs the old and new field values into a new Chatter "notification" message tied to the project.
6. Open the project record and click the "Chatter" icon (the activity feed visible to any user with access to the record).
7. Observe: the payload executes immediately on render — no further interaction is required. |
|---|
| Usuario | P0lt (UID 100338) |
|---|
| Sumisión | 2026-08-10 05:40 (hace 2 meses) |
|---|
| Moderación | 2026-09-27 12:14 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 408116 [aureuserp Aureus ERP hasta 1.5.x Chatter old_value/new_value secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 0 |
|---|