Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-06T12:16:28.293Z",
  "pubdate": "2026-08-06T12:16:28.293Z",
  "executiveSummary": "An improper neutralization of input during web page generation vulnerability, commonly known as Stored Cross-Site Scripting (XSS), has been identified in the Logo Software Industry and Trade Inc. e-Logo Purchasing Portal. This security flaw enables authenticated or remote malicious actors to inject arbitrary client-side scripts into the application's persistent data storage, which are subsequently executed within the context of other users' browsers when they view the compromised web pages.\nThe vulnerability directly impacts the e-Logo Purchasing Portal for all versions prior to 1.52. Successful exploitation of this flaw can lead to severe security implications, including session hijacking, credential theft, unauthorized actions performed on behalf of victim users, and defacement of the application interface.\nThe risk level is significant due to the stored nature of the payload, meaning a single successful injection can persistently compromise multiple victims accessing the affected portal components without requiring continuous interaction from the attacker.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and lack of contextual output encoding within the e-Logo Purchasing Portal. Specifically, the application accepts user-supplied data through input vectors without properly neutralizing or escaping characters that possess special meaning in the Hypertext Markup Language (HTML) and JavaScript parsing contexts.\nThe root cause is located in the application's failure to implement robust input validation and output encoding mechanisms prior to storing user-submitted data in the underlying database and subsequently rendering it back to users via the web interface. This affects the e-Logo Purchasing Portal prior to version 1.52.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious payload containing JavaScript or HTML elements (such as <script> tags or event handlers like onload or onerror). Second, the attacker submits this payload through an application feature that stores data persistently within the portal. Third, the application stores the unsanitized input in the database without applying proper validation. Fourth, when a victim user navigates to the affected page, the server retrieves the malicious payload from storage and injects it into the HTTP response without appropriate output encoding. Finally, the victim's browser parses the response and executes the injected script within the security context of the victim's session, potentially exposing sensitive data such as session cookies, tokens, or allowing unauthorized API requests.\nDepending on the specific functionality of the portal, exploitation may require authentication or specific privilege levels to inject the persistent payload, though the resulting impact affects any user viewing the compromised component over the network."
}