CVE-2022-24957

An attacker who is authorized to create or edit information objects in the content section can inject a persistent XSS payload by entering a crafted name such as `<img src=x onerror=alert(1)>` [ref_id=1]. The payload is stored on the server and executed in any user's browser when they open the version or history tab of the manipulated object [ref_id=1]. No special network position is required beyond normal authenticated access to the application.

The vulnerability resides in the handling of information object names in the DHC Vision eQMS application. When a user creates or edits an information object, the name field is stored without proper sanitization and later reflected unsanitized into the server response on the version and history tabs [ref_id=1]. The advisory does not specify exact file paths or function names.

As of the public disclosure date (2022-03-28), the advisory states the solution status is "Open" and no solution date was provided [ref_id=1]. No patch is included in the bundle. The manufacturer was notified on 2022-02-10, but no fix had been released at the time of disclosure [ref_id=1]. Remediation would require implementing proper output encoding for the name field wherever it is reflected in server responses, particularly on the version and history pages.

1. Log in to DHC Vision eQMS with an account that has permission to create or edit information objects. 2. Right-click on a document you can edit, or create a new information object. 3. Enter `<img src=x onerror=alert(1)>` as the name of the new or editable object. 4. After saving, open the "versions" tab. 5. The alert will pop up, confirming the XSS [ref_id=1].