Description

UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. Attackers with ROLE_AGENT can inject malicious script into the identifier field, which is persisted and executed when other members access the configuration update page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T14:17:14.303Z",
  "pubdate": "2026-09-21T14:17:14.303Z",
  "executiveSummary": "The UVdesk core-framework contains a stored cross-site scripting (XSS) vulnerability residing within the SwiftMailer configuration identifier parameter.\nThe vulnerability allows an authenticated attacker with ROLE_AGENT privileges to inject arbitrary malicious scripts into the application's configuration settings.\nThis injected payload is persisted in the database and subsequently executed in the browsers of other authenticated users, such as administrators, when they access the specific configuration update page.\nThe primary impact of this vulnerability is unauthorized execution of client-side code, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.\nThe vulnerability affects versions prior to 1.1.7 and requires an attacker to possess valid agent-level credentials to successfully execute the payload.\nRisk implications include potential privilege escalation and compromise of sensitive helpdesk administrative data.",
  "technicalDetails": "The vulnerability is a classic stored XSS flaw located within the core-framework component of the UVdesk helpdesk system. The flaw exists specifically in the handling of the 'identifier' parameter during the processing of the 'createMailerConfiguration' action.\nRoot cause analysis indicates that the application fails to perform adequate input sanitization or output encoding on user-supplied data transmitted to the SwiftMailer configuration module. When a user with ROLE_AGENT privileges submits a configuration update, the system accepts the 'identifier' string and stores it directly into the persistence layer without sanitizing active content or employing context-aware output escaping.\nThe attack flow proceeds as follows: First, an attacker authenticated as a helpdesk agent navigates to the mailer configuration settings. Second, the attacker interacts with the 'createMailerConfiguration' action and injects a malicious script payload into the 'identifier' parameter field. The backend application processes this request and commits the unsanitized payload to the database.\nThe vulnerability manifests when another user with sufficient privileges (such as a system administrator) visits the configuration update page. The server fetches the stored, malicious 'identifier' from the database and renders it within the HTML response sent to the administrator's browser. Because the application does not neutralize the script, the victim's browser interprets the payload as legitimate executable code.\nThis execution occurs within the security context of the victim's session. Consequently, the script can access sensitive session cookies, perform requests to administrative endpoints, or exfiltrate sensitive data displayed on the dashboard. Because the payload is persistent, the script triggers every time the affected configuration page is loaded, ensuring repeated execution against any user who accesses the compromised module.\nThe scope of exploitation is limited by the requirement of ROLE_AGENT authentication, meaning the attack vector is internal; however, the impact is significant due to the potential for administrative account takeover within the helpdesk environment.\nVulnerable versions include all releases of the UVdesk core-framework prior to 1.1.7."
}