OpenZ ERP 3.6.60 – Persistent Cross-Site Scripting
A persistent cross site scripting web vulnerability has been discovered in the official OpenZ v3.6.60 ERP web-application. The vulnerability allows remote attackers to inject own malicious script codes with persistent attack vector to compromise browser to web-application requests from the application-side. The persistent vulnerability is located in the `inpname` and `inpdescripción` parameters of the `Employee` add/register/edit module in the `menu.html` file. Remote attackers with low privileges are able to inject own malicious persistent script code as name or description. The injected code can be used to attack the frontend or backend of the web-application. The request method to inject is POST and the attack vector is located on the application-side. The attack can be triggered from low privilege user accounts against higher privilege user accounts like manager or administrators to elevate privileges via session hijacking. Successful exploitation of the vulnerabilities results in session hijacking, persistent phishing attacks, persistent external redirects to malicious source and persistent man
