-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a stored Cross-Site Scripting (XSS) in the 'Create New Customer' feature of Bagisto. The analysis of the commits between the vulnerable version (2.3.7) and the patched version (2.3.8) reveals a significant security enhancement in commit 8076c708498a0187bc952d5f5f705e0cb1919682. This commit introduces a new dependency, stevebauman/purify, which is a well-known HTML sanitizer for Laravel. It also adds a new helper function, clean_content, that utilizes this library to sanitize content. Although the commit message and the immediate application of this fix shown in the patch are for 'product attributes', the introduction of this generic sanitization function is the key to fixing XSS vulnerabilities throughout the application, including the one in the customer creation form. The vulnerability exists because the controller methods that handle customer creation and updates (likely store and update in a CustomerController) were accepting user input (e.g., first_name, last_name) and saving it to the database without proper sanitization. When this stored data, containing malicious scripts, was later rendered on a page (e.g., customer list or edit page), the scripts would execute in the user's browser. The patch addresses this by providing the clean_content function, which is then used within a Form Request's passedValidation method to sanitize the input before it reaches the controller. While the specific patch for the customer-related forms and controllers is not directly visible in the provided information, the introduction of the sanitization mechanism itself is the crucial piece of evidence. The vulnerable functions are those that process and display user-generated content without proper sanitization, and the fix is the application of the new clean_content function at the input validation stage.
Webkul\DataGrid\Exports\DataGridExport::mappackages/Webkul/DataGrid/src/Exports/DataGridExport.php
Webkul\Admin\Http\Requests\ProductForm::passedValidationpackages/Webkul/Admin/src/Http/Requests/ProductForm.php
clean_contentpackages/Webkul/Core/src/Http/helpers.php
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bagisto/bagisto | composer | <= 2.3.7 | 2.3.8 |
Ongoing coverage of React2Shell