Description

Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-change log where old_value and new_value entries are rendered without proper escaping. Any user permitted to edit tracked text fields can inject malicious markup that executes when other users, including administrators, view the record's Chatter panel.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T14:17:30.340Z",
  "pubdate": "2026-09-21T14:17:30.340Z",
  "executiveSummary": "Aureus ERP versions prior to 1.6.0 are susceptible to a stored cross-site scripting (XSS) vulnerability located within the Chatter field-change log functionality. This flaw allows an authenticated attacker to inject arbitrary malicious markup into the 'old_value' or 'new_value' fields during a tracked field modification. Because the application fails to perform adequate output encoding or sanitization before rendering these values in the user interface, the injected script executes within the security context of any user viewing the affected record's Chatter panel.\nThe impact is significant, as the vulnerability affects administrative users who frequently audit record logs. An attacker capable of modifying tracked fields can leverage this vulnerability to hijack administrative sessions, steal session cookies, perform unauthorized actions on behalf of other users, or redirect victims to malicious external domains. Exploitation requires the attacker to have legitimate access to modify tracked text fields within the ERP environment, making this an elevation of privilege or lateral movement vector for malicious insiders or compromised accounts.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper input-to-output handling mechanism within the Chatter module. When a tracked field is updated, Aureus ERP generates log entries capturing the previous state (old_value) and the current state (new_value). The application backend stores these values in the database without sanitizing HTML entities. When a user navigates to the Chatter panel, the application retrieves these raw strings and injects them directly into the Document Object Model (DOM) of the browser without implementing necessary server-side or client-side encoding (e.g., escaping <, >, \", and ' characters).\nExploitation follows a specific attack flow: First, an authenticated attacker identifies a text field that is configured for Chatter auditing. Second, the attacker updates this field with a malicious payload, such as a script tag containing arbitrary JavaScript or an event handler attribute (e.g., <img src=x onerror=alert(document.cookie)>). Third, the application processes the update and commits the unsanitized payload to the database as the 'new_value'. Fourth, when an unsuspecting victim, such as a system administrator, views the record history in the Chatter panel, the server serves the record, and the browser parses the payload as executable code.\nBecause the payload executes in the context of the victim's session, the attacker inherits the victim's permissions. This allows for the execution of administrative API calls, exfiltration of sensitive ERP data, or modification of application configurations. The vulnerability is persistent, meaning the payload remains active every time the audit log is viewed until the database entry is manually purged or the application logic is updated to encode output. The requirement for a user to have permission to edit fields limits the attack surface to authenticated users, but it remains a critical vulnerability for environments where role-based access control is not strictly enforced or where compromised standard-user accounts are present. There is no evidence of client-side validation, and the flaw is inherently tied to the server-side rendering logic of the Chatter feature component."
}