| 제목 | Webkul Aureus ERP v1.6.0 Cross Site Scripting |
|---|
| 설명 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Payment Term note field of AureusERP v1.6.0. The Payment Term REST API accepts arbitrary HTML/JavaScript in the note parameter without performing server-side sanitization, as the field is validated only as a nullable string. The stored value is subsequently rendered by the Filament admin panel using HtmlString, causing the application to output the content as raw HTML without sanitization. Although the TipTap-based admin interface does not normally allow direct <script> injection because its editor representation escapes such content, an authenticated user with permission to update Payment Terms can bypass this client-side restriction by submitting a crafted payload directly to the REST API. Once stored, the payload executes in the browser of any user who subsequently views the affected Payment Term record, including administrators. Because the JavaScript executes within the application's origin and the victim's authenticated browser session, it may perform actions and access data permitted to the victim's account, making this a persistent stored XSS vulnerability.
Researchers Information
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Devansh Sanghvi
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/Devansh10845
LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
|---|
| 원천 | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Stored_XSS/Readme.md |
|---|
| 사용자 | KaranParelkar (UID 99714) |
|---|
| 제출 | 2026. 09. 11. AM 10:47 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 03:57 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 407321 [Webkul Aureus ERP 까지 1.6.0 Accounting Plugin Payment Term note 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 0 |
|---|