Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-04T14:17:17.963Z",
  "pubdate": "2026-09-04T14:17:17.963Z",
  "executiveSummary": "The Gastromenum Ticket and QR Menu System contains a vulnerability categorized as Improper Neutralization of Input During Web Page Generation, commonly referred to as Stored Cross-Site Scripting (XSS).\nThis vulnerability exists due to the application's failure to adequately sanitize user-supplied input before rendering it in web pages, allowing an attacker to inject and persist malicious scripts within the application's database.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript in the browser of other users, including administrators, when they access the compromised content.\nThe vulnerability affects Gastromenum Ticket and QR Menu System versions prior to 2026.08.31.\nThe potential impact includes session hijacking, unauthorized actions on behalf of the victim, defacement, and the redirection of users to malicious websites.\nExploitation requires the attacker to submit malicious payloads through vectors that the system subsequently renders for other users. The risk level is considered high due to the potential for unauthorized privilege escalation and information theft.",
  "technicalDetails": "The vulnerability is identified as a Stored XSS issue within the Gastromenum Ticket and QR Menu System, occurring when the application fails to perform sufficient input validation or output encoding on user-controlled data that is later stored in the backend database.\nThe root cause of this flaw is the insecure handling of data input by the application's interface. When data provided by a user is persisted into the database without undergoing strict sanitization or proper context-aware output encoding (such as HTML entity encoding), the application treats the malicious payload as executable code rather than plain text.\nThe attack flow typically involves an attacker identifying an input field or parameter within the application that accepts data intended for display to other users. The attacker crafts a payload—typically a script tag containing arbitrary JavaScript—and submits it through the vulnerable input vector. The system accepts this malicious input and stores it directly into the server-side database.\nWhen a legitimate user, such as a menu administrator or a customer, navigates to a page that fetches and renders this stored, unsanitized data, the user's browser parses the malicious script. Because the browser interprets the script as part of the page's legitimate content, it executes the payload within the context of the victim's session.\nThe execution of this malicious payload allows the attacker to bypass the Same-Origin Policy (SOP). The script can access document cookies (if the HttpOnly flag is not properly implemented), session tokens, and local storage. Furthermore, the attacker can manipulate the Document Object Model (DOM) to perform actions on behalf of the victim, exfiltrate sensitive data, or install persistent client-side hooks to maintain access.\nThis vulnerability is present in versions of the Gastromenum Ticket and QR Menu System prior to 2026.08.31. Given the nature of the vulnerability, it is exploitable over the network and does not necessarily require the attacker to have administrative privileges initially, provided they can reach the input vector, though the ultimate impact depends on the privileges of the victim viewing the stored payload."
}