Description
Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Webkul | Aureus ERP | ≤ 1.6.0 | — |
References
- https://github.com/aureuserp/aureuserp/pull/1562 patch issue-tracking
- https://hackmd.io/@leediay/stored-xss-aureus-via-payment-term exploit
- https://github.com/aureuserp/aureuserp/blob/v1.6.0/plugins/webkul/accounts/src/Filament/Resources/PaymentTermResource/Schemas/PaymentTermInfolist.php#L59 technical-description
- https://github.com/aureuserp/aureuserp product
- VulnCheck Advisory: Aureus ERP through 1.6.0 Stored XSS via Payment Term Note third-party-advisory