Description
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
aureuserp aureuserp
Default version status: unaffected
0 to ≤ 1.6.0affected
pkg:github/aureuserp/aureuserpReferences
- https://hackmd.io/@leediay/Bk4Vpz0ife ↗
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleForm.php#L121-L153 ↗
- https://github.com/aureuserp/aureuserp/blob/b33fa04643a936885f83b5ad39a62260ef27a7a0/plugins/webkul/inventories/src/Filament/Clusters/Configurations/Resources/RuleResource/Schemas/RuleInfolist.php#L24-L43 ↗
- https://github.com/aureuserp/aureuserp/pull/1619 ↗
- https://github.com/aureuserp/aureuserp ↗
- https://www.vulncheck.com/advisories/aureus-erp-through-1.6.0-stored-xss-via-inventory-rule-action-information ↗