Description

Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a low-privileged role such as Cashier can submit a leave request through the HRM/Leave module, causing the unsanitized first-name markup to execute in the browser session of any higher-privileged user who views the leave-application notification pane, enabling cross-user session compromise within the admin origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T12:19:47.147Z",
  "pubdate": "2026-08-12T12:19:47.147Z",
  "executiveSummary": "Ultimate POS (Stock Management & Point of Sale) contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup.\nThe vulnerability resides in the user first-name field, which fails to adequately sanitize input during account creation.\nAttackers holding a low-privileged role, such as Cashier, can exploit this flaw by submitting a leave request through the HRM/Leave module.\nWhen a higher-privileged user views the leave-application notification pane, the unsanitized first-name markup executes within their browser session.\nThis enables cross-user session compromise within the administrative origin, potentially leading to unauthorized administrative actions and privilege escalation.\nSuccessful exploitation requires low-privileged authentication, access to account creation or profile configuration, and user interaction from a higher-privileged victim reviewing notifications.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) issue originating from improper input sanitization and output encoding within the Ultimate POS (Stock Management & Point of Sale) application.\nThe vulnerable component involves the user first-name field and the HRM/Leave module notification pane.\nAuthentication and privilege requirements include a low-privileged authenticated attacker, specifically possessing a role such as Cashier, who has the capability to modify or set a malicious payload in the user first-name field.\nThe root cause stems from the application accepting raw HTML and script input during account creation or profile modification and subsequently rendering this data without appropriate contextual output encoding inside the administrative notification interface.\nThe attack flow proceeds in a structured sequence: First, the low-privileged attacker populates their user first-name field with a malicious script payload. Second, the attacker interacts with the HRM/Leave module to submit a leave request. Third, a higher-privileged user navigates to or views the leave-application notification pane where the pending requests are listed. Fourth, the application retrieves the attacker's stored first-name value from the database and renders it directly into the Document Object Model (DOM) of the victim's browser session without sanitization. Fifth, the injected script executes within the context of the higher-privileged user's session.\nThe payload behavior executes arbitrary JavaScript code within the higher-privileged user's browser, operating under the admin origin.\nThe post-exploitation impact includes cross-user session compromise, allowing the attacker to hijack administrative sessions, perform unauthorized administrative actions, or pivot further within the application context."
}