| タイトル | Webkul Aureus ERP v1.6.0 Cross Site Scripting |
|---|
| 説明 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Payment Term note field of AureusERP v1.6.0. The Payment Term REST API accepts arbitrary HTML/JavaScript in the note parameter without performing server-side sanitization, as the field is validated only as a nullable string. The stored value is subsequently rendered by the Filament admin panel using HtmlString, causing the application to output the content as raw HTML without sanitization. Although the TipTap-based admin interface does not normally allow direct <script> injection because its editor representation escapes such content, an authenticated user with permission to update Payment Terms can bypass this client-side restriction by submitting a crafted payload directly to the REST API. Once stored, the payload executes in the browser of any user who subsequently views the affected Payment Term record, including administrators. Because the JavaScript executes within the application's origin and the victim's authenticated browser session, it may perform actions and access data permitted to the victim's account, making this a persistent stored XSS vulnerability.
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Devansh Sanghvi
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/Devansh10845
LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
|---|
| ソース | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Stored_XSS/Readme.md |
|---|
| ユーザー | KaranParelkar (UID 99714) |
|---|
| 送信 | 2026年09月11日 10:47 (1 月 ago) |
|---|
| モデレーション | 2026年10月11日 15:57 (1 month later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 407321 [Webkul Aureus ERP 迄 1.6.0 Accounting Plugin Payment Term note クロスサイトスクリプティング] |
|---|
| ポイント | 0 |
|---|