Cross-site Scripting (XSS) - Stored in unilogies/bumsys

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the unilogies/bumsys project, a simple business management system. The bug affects all versions prior to v2.0.1 [1]. The vulnerability is present in the application's input handling, where user-supplied data is not properly sanitized before being stored and later rendered in the browser, enabling malicious script injection.

Exploitation

An attacker with the ability to submit data to the application (such as through user registration, profile updates, or form submissions) can craft a payload containing JavaScript code. The attacker does not need special privileges beyond normal application access. The injected script will be stored on the server and executed in the context of any user who views the affected page, including administrators [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the application's security context. This can lead to session hijacking, data theft, defacement, or phishing attacks. The impact is moderate, as the attacker gains the same privileges as the victim user [2].

Mitigation

The vulnerability has been fixed in version 2.0.1 of bumsys. Users should upgrade to this version immediately. The fix is referenced in the commit at the project's GitHub repository [1]. No workaround is available for older versions.