| 제목 | Webkul aureuserp 1.5.0 Cross Site Scripting |
|---|
| 설명 | A stored cross-site scripting (XSS) vulnerability exists in the Chatter activity-log feature of aureuserp/aureuserp (commit 8409fde) due to unsafe rendering of user-controlled input in the Filament view `content-text-entry.blade.php`. When a tracked field on a model (e.g. a Project's `Name`) is edited, `HasLogActivity::logModelActivity()` stores the field's old and new values verbatim, with no HTML sanitization, in the Chatter message's `properties` column. The Blade view then outputs those `old_value`/`new_value` diffs using Blade's unescaped syntax (`{!! !!}`), allowing arbitrary HTML and JavaScript to be injected and persisted. Any authenticated user able to edit a tracked field on any of 18 affected models (Projects, Tasks, Sales/Purchase Orders, Leaves, Manufacturing Orders, Payments, and more) can store a malicious payload that executes in the browser of any user — including a higher-privileged admin — who later opens that record's Chatter feed, potentially leading to session/credential compromise, unauthorized actions performed in the victim's context, and data exfiltration from the application panel.
Steps to reproduce:
1. Log in to the AureusERP admin panel as any authenticated user with permission to create/edit a Project (`/admin/project/projects`).
2. Create a new project with any placeholder name (e.g. "Test Project") and save it.
3. Open the project and click "Edit".
4. Replace the ""Name" field's value with a payload such as:
`<img src=x onerror=alert("XSS")>`
5. Click "Save changes". This triggers `HasLogActivity::logModelActivity('updated')`, which logs the old and new field values into a new Chatter "notification" message tied to the project.
6. Open the project record and click the "Chatter" icon (the activity feed visible to any user with access to the record).
7. Observe: the payload executes immediately on render — no further interaction is required. |
|---|
| 사용자 | P0lt (UID 100338) |
|---|
| 제출 | 2026. 08. 10. AM 05:40 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 27. PM 12:14 (2 months later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 408116 [aureuserp Aureus ERP 까지 1.5.x Chatter old_value/new_value 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|