Description
OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel displayed on nearly every page via lib/MRU.php's getFormatted() function. Attackers can exploit this by crafting a malicious record name that executes arbitrary JavaScript in the session of any other user, including Site Administrators, who views the record, enabling session/cookie theft and privilege escalation to full administrative control.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opencats OpenCATS
Default version status: unaffected
0.10.0 to < 0.12.0affected
pkg:github/opencats/OpenCATSReferences
- https://github.com/opencats/OpenCATS/commit/f82e0ee3045845b90b7e111c46f30998496e38a8 ↗
- https://github.com/opencats/OpenCATS/commits/master/lib/MRU.php ↗
- https://github.com/opencats/OpenCATS/releases/tag/v0.12.0 ↗
- https://www.vulncheck.com/advisories/opencats-before-stored-xss-via-mru-navigation-panel ↗