header-logo
Suggest Exploit
vendor:
ERPnext
by:
Veerababu Penugonda
6.1
CVSS
MEDIUM
Cross-Site Scripting
79
CWE
Product Name: ERPnext
Affected Version From: 11.x.x
Affected Version To: 11.x.x
Patch Exists: YES
Related CWE: CVE-2018-11339
CPE: a:erpnext:erpnext
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Mozilla Firefox quantum 60.1, Ubuntu OS
2018

ERPnext 11.x.x – Cross-Site Scripting

ERPnext v11.x.x-develop is vulnerable to XSS like Stored, Reflected, Cookie, and possibly more. The vulnerability can be exploited by entering a malicious payload such as '><script>alert(1)</script>' into the 'Comment' field of the 'Form/Asset Repair/ARLOG-000015' page.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in the application.
Source

Exploit-DB raw data:

# Exploit Title: ERPnext 11.x.x - Cross-Site Scripting
# Date: 2018-05-10
# Exploit Author: Veerababu Penugonda
# Vendor Homepage: https://erpnext.com/
# Software Link: https://demo.erpnext.com/
# Version: Frappe ERPNext v11.x.x-develop
# Tested on: Mozilla Firefox quantum 60.1 , Ubuntu OS
# CVE : CVE-2018-11339

# 1. Description:
# https://demo.erpnext.com/desk#Form/Asset%20Repair/ARLOG-000015
# and functionality “Comment” is vulnerable to XSS like Stored ,
# Reflected , Cookie , possible for more

# 2. Payload : 

"><script>alert(1)</script>

Navigation

Suggest Exploit

Services By CQR