Submeter #972881: Webkul Aureus ERP v1.6.0 Cross Site Scripting

A stored Cross-Site Scripting (XSS) vulnerability exists in the Payment Term note field of AureusERP v1.6.0. The Payment Term REST API accepts arbitrary HTML/JavaScript in the note parameter without performing server-side sanitization, as the field is validated only as a nullable string. The stored value is subsequently rendered by the Filament admin panel using HtmlString, causing the application to output the content as raw HTML without sanitization. Although the TipTap-based admin interface does not normally allow direct <script> injection because its editor representation escapes such content, an authenticated user with permission to update Payment Terms can bypass this client-side restriction by submitting a crafted payload directly to the REST API. Once stored, the payload executes in the browser of any user who subsequently views the affected Payment Term record, including administrators. Because the JavaScript executes within the application's origin and the victim's authenticated browser session, it may perform actions and access data permitted to the victim's account, making this a persistent stored XSS vulnerability.

Researchers Information

Researcher - 1

Name: Karan Parelkar

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/KaranParelkar

LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/

Researcher - 2

Name: Devansh Sanghvi

Independent Security Researcher

Email: [email protected]

GitHub: https://github.com/Devansh10845

LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/

• Fonte: ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Stored_XSS/Readme.md
• Utilizador: KaranParelkar (UID 99714)
• Submissão: 11/09/2026 10h47 (há 1 mês)
• Moderação: 11/10/2026 15h57 (1 month later)
• Estado: Duplicado
• Entrada VulDB: 407321 [Webkul Aureus ERP até 1.6.0 Accounting Plugin Payment Term note Script de Site Cruzado]
• Pontos: 0