提交 #870360: Webkul Bagisto <=2.4.4 HTML Injection

Bagisto 2.4.4 contains an unauthenticated HTML injection vulnerability in customer-registration notification emails sent to administrators. An unauthenticated frontend user can register a customer account with crafted name fields and inject arbitrary HTML into the generated admin notification email.

The affected flow is the public customer registration feature at POST /customer/register. User-supplied first_name and last_name values are stored and later combined into the customer name. When the admin registration notification email is generated, the customer name is interpolated into an HTML link and rendered with raw Blade output. Because the user-controlled name is not safely escaped before being placed in the raw HTML email context, an attacker can inject arbitrary HTML into the email body.

The impact is cross-trust-boundary HTML injection from unauthenticated frontend input into an administrative communication channel. An attacker can insert deceptive text, fake links, fake buttons, or other misleading visual elements into emails received by administrators or internal recipients. This can support phishing-style attacks and content spoofing against users who trust the administrative notification channel. Depending on mail client behavior, unsafe HTML handling may increase the risk further.

The vendor was contacted beforehand and confirmed the report. No CVE is included in the public report at the time of preparation.

• 来源: ⚠️ https://github.com/Mitchell45/PHP_Web_POCs/blob/main/Bagisto/42_english_vulnerability_report.md
• 用户: Mitch45 (UID 99299)
• 提交: 2026-06-26 06時50分 (2 月前)
• 管理: 2026-08-17 18時16分 (2 months later)
• 状态: 已接受
• VulDB条目: 391310 [Webkul Bagisto 直到 2.4.4 Customer-Registration Notification Email /customer/register first_name/last_name 跨网站脚本]
• 积分: 20