Bagisto CVE-2025-62414

Exploitation requires an authenticated account with access to the admin panel's 'Create New Customer' form (reached via Sales > Orders > create customer); the attacker injects script into the first_name and last_name input fields, which are stored without output encoding. Execution is NOT immediate or attacker-controlled: it is gated by a second user (per UI:R) - specifically an admin or other viewer later opening the stored customer record in a grid, listing, or detail view - so the payload only fires when such a victim views injected data. Limiting factors: requires valid admin/backend credentials (per the CVSS PR:H; the advisory's 'limited privilege' claim is unverified), requires victim interaction (viewing the record), and affects only Bagisto 2.3.7 and earlier (fixed in 2.3.8).

This is a stored Cross-Site Scripting flaw (CWE-80) in Bagisto 2.3.7's admin 'Create New Customer' feature, and the signals consistently point to a moderate, not critical, priority. The CVSS 3.1 score is 4.8 (Medium) with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N: although the attack vector is network, exploitation requires an authenticated privileged account (PR:H) with access to the admin create-customer form AND a victim to later view the injected record (UI:R), which materially constrains real-world risk. EPSS is low at 0.28% (19th percentile), indicating a low modeled probability of near-term mass exploitation, and the CVE is NOT on the CISA KEV list - there is no evidence of active exploitation. Publicly available exploit code exists (the GHSA advisory includes a working PoC payload), so the barrier to weaponization against a known Bagisto instance is low, but PoC availability is distinct from active exploitation. Note a tension worth verifying: the official GHSA advisory describes the attacker as having 'limited privilege' and labels this stored XSS 'high severity,' whereas the assigned CVSS uses PR:H (high privilege) and yields only Medium - the practical privilege needed to reach the admin create-customer form should be confirmed with the vendor, since a lower privilege requirement would raise real risk. Overall: a legitimate issue to patch, but a privilege-and-interaction-gated stored XSS rather than an unauthenticated internet-facing emergency.

An attacker who already has access to the Bagisto admin panel's create-customer form submits a customer record with a malicious payload (e.g. "><svg/onload=prompt(document.domain)>) in the first_name/last_name fields, which is stored unsanitized. When another administrator later opens the customer grid or detail view, the script executes in that admin's authenticated browser session, enabling cookie/session theft or admin-level actions on their behalf. A public PoC with this exact payload is documented in the vendor's GHSA advisory.