CVE-2019-25312

InoERP 0.7.2 - Persistent Cross-Site Scripting

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79

InoERP 0.7.2 contains a persistent cross-site scripting vulnerability in the comment section that allows unauthenticated attackers to inject malicious scripts. Attackers can submit comments with JavaScript payloads that execute in other users' browsers, potentially stealing cookies and session information.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Affected products

InoIdeas · InoERP

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://inoideas.org/https://github.com/inoerp/inoERP https://www.exploit-db.com/exploits/47428 https://www.vulncheck.com/advisories/inoerp-persistent-cross-site-scripting