CVE-2023-39714

Vulnerability

Free and Open Source Inventory Management System v1.0 [1] contains multiple stored cross-site scripting (XSS) vulnerabilities in the Add New Member section under the Suppliar (Supplier) page. The Name, Address, and Company parameters are not sanitized before being stored and later displayed, allowing injection of arbitrary HTML and JavaScript. The vulnerability is reachable through the registration and supplier management workflows.

Exploitation

An attacker must first register an account or have access to the registration page. After logging in, the attacker navigates to the Suppliar section and clicks "Add New Member". In the Name, Address, or Company fields, the attacker injects a payload such as "> and submits the form. The payload is stored and subsequently executed when any user (e.g., an administrator) views the member list, triggering the XSS [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, theft of sensitive data, or further attacks against the application and its users. The impact depends on the privileges of the victim; an administrator compromise could result in full application control.

Mitigation

As of the publication date, no official patch has been released by the vendor. The software is provided as open source, but no update addressing this vulnerability is available. Users should implement input validation and output encoding for all user-supplied data, especially in the affected fields. Additionally, consider using a Web Application Firewall (WAF) to filter malicious payloads. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.