| 제목 | Webkul Bagisto <=2.4.4 Cross Site Scripting |
|---|
| 설명 | Bagisto 2.4.4 contains a stored cross-site scripting vulnerability in RMA conversation messages. A normal authenticated frontend customer can inject malicious HTML or JavaScript into an RMA message and have it execute later when the message is viewed in frontend and backend RMA views.
The affected flow uses POST /customer/account/rma/send-message to submit an RMA conversation message. The frontend applies client-side sanitization before sending the request, but this can be bypassed by intercepting and modifying the request. The server validates the message only as a string and stores the raw value. Later, both the frontend RMA view and the backend admin RMA view render the stored message through v-html, causing attacker-controlled HTML to be inserted into the DOM.
The impact is stored XSS across trust boundaries. A customer can persist script content in RMA conversation history, and the payload can execute when viewed by the same customer, other users with access to the conversation, or backend administrators reviewing the RMA. In an admin context, successful exploitation may allow theft of sensitive page data, session-related abuse depending on browser protections, or privileged actions performed through the administrator's authenticated session.
The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.
|
|---|
| 원천 | ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/39_english_vulnerability_report.md |
|---|
| 사용자 | Mitch45 (UID 99299) |
|---|
| 제출 | 2026. 06. 26. AM 06:46 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 16. PM 08:05 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 391196 [Webkul Bagisto 까지 2.4.4 RMA Message send-message 메시지 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|