Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| aureuserp | aureuserp | ≤ 1.6.0 | — |
References
- https://hackmd.io/@leediay/Bk4Vpz0ife technical-description exploit
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php#L121-L153 technical-description
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleInfolist.php#L24-L43 technical-description
- https://github.com/aureuserp/aureuserp/pull/1619 patch issue-tracking
- https://github.com/aureuserp/aureuserp product
- VulnCheck Advisory: Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information third-party-advisory