Stored XSS Vulnerability Found in Party Field Leading to Arbitrary JavaScript Execution
**Affected Feature:** Party Field (Anywhere the Party field is utilized, such as Company and Employee Modules) **Severity:** High - Stored Cross-Site Scripting (XSS) allowing arbitrary JavaScript execution in other users' browsers. **Summary** When creating a new Party entry with a crafted payload in the "Name" field (e.g., _\<img src=x onerror=alert('XSS-Party')\>_), this malicious JavaScript is stored in the database. The payload is executed when searching for and selecting a Party in the Party field of other forms (such as creating a new Company or adding a new Employee). This results in JavaScript execution in the context of the user viewing the affected Party. The attack could lead to cookie/session theft, UI manipulation, data exfiltration, or other malicious actions. **Note:** The issue is present across any module that utilizes the Party field, meaning the attack can persist across various parts of the application as long as the Party field is used. **Impact** * Remote execution of arbitrary JavaScript in the context of the web app for any user interacting with the affected Party entry. * Potential account takeover (if session cookies are accessible), unauthorized actions, or disclosure of sensitive data. * Since the Party entries are stored, the attack persists until the Party entry is removed or the vulnerability is patched. * The attack affects all users who interact with the affected Party, making it a widespread issue across modules. **Proof-Of-Concept** Create a new Party with the payload (\<img src=x onerror=alert('XSS-Party')\>)in the **Name** field: ![Creating_Party.png](/uploads/cbcd5f6c72fb170c43cbedbd868ea483/Creating_Party.png){width="1150" height="590"} **Evidence of Exploitation** 1. Under the Companies module, attempt to add a new Company and search for the Party in the Party field. This will trigger the XSS payload. ![Companies_page_with_XSS.png](/uploads/f6ab6f7b715b77ca7920ef3fd5098223/Companies_page_with_XSS.png){width="773" height="381"} * Similarly, under the **Employees**, attempt to add a new Employee and search for the Party in the **Party** field. This will also trigger the XSS payload. ![Employees_page_with_XSS.png](/uploads/21c174c77ad808bd1a55b70e796ee8ee/Employees_page_with_XSS.png){width="934" height="429"} * This was also observed when attempting to add a new Bank. ![image.png](/uploads/0ff7682ca33bf624a588589a46a99738/image.png) Please let me know once the fix for this issue has been implemented, as I would like to ensure that it has been properly addressed. If possible, I would also like to request a CVE for this issue.
issue