Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-4v7v-7v7r-3r5h
No affected components available
Summary
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where historical data is rendered without proper HTML entity encoding. This allows an attacker to execute arbitrary JavaScript in the browser of viewing the history by administrators.
Details
When an administrator views the History tab of that specific note, the script executes in their browser session.
PoC
-
Log in as a regular user.
-
Open "Sales"=>"Customers"=> "Delivery Notes"
<img width="818" height="223" alt="image" src="https://github.com/user-attachments/assets/82518644-2676-42db-93b1-86133986276c" /> -
Chose one of the customer or create the new one.
-
Open "Delivery notes"
<img width="2078" height="713" alt="image" src="https://github.com/user-attachments/assets/f7e5027f-e574-4807-9e9c-bf8a51bc1fff" /> -
Create a new Delivery Note or edit an existing one. Fill the "Number 2" field with any value and save.
<img width="2097" height="739" alt="image" src="https://github.com/user-attachments/assets/a3ca5ccb-3d9a-4cfc-a991-16206a1a862b" />
Result: Upon opening the history record, the onerror event triggers, executing the JavaScript and displaying an alert box with the application's origin.
Impact
Change admin password via XSS: <img width="2094" height="1260" alt="image" src="https://github.com/user-attachments/assets/7598f986-0618-46e1-9dc7-64655975b19e" /> <img width="1584" height="1137" alt="image" src="https://github.com/user-attachments/assets/3e2302bc-01a3-4c47-ba9a-e69413e932b3" /> <img width="2084" height="373" alt="image" src="https://github.com/user-attachments/assets/21523278-5bcc-4743-8557-4b6563a127d0" /> <img width="1665" height="787" alt="image" src="https://github.com/user-attachments/assets/eca4d5b7-5dec-410f-9c59-99084821e350" /> Admin password was changed <img width="1488" height="598" alt="image" src="https://github.com/user-attachments/assets/53d3f4c1-accd-4136-8235-0fe5b287bbfe" />
This vulnerability results in a Critical Full Account Takeover, allowing any user with note-editing permissions to seize control of the admin account. It successfully bypasses CSRF protections and exploits the lack of "current password" verification during credential changes. Once compromised, the attacker gains total access to the system's management, sensitive financial data, and user configurations.
Technical requirements & Complexity
The attack requires prior technical knowledge of the internal API structure (field names and required values), which can be obtained by a legitimate user through browser developer tools. While it requires the target's code (e.g., admin), this is a common default value in most installations.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.
Exploitation activity has been observed. Apply available patches or mitigations urgently.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard