Aureuserp
Monthly
Aureus ERP installations running the Webkul Chatter plugin before version 1.5.0 expose every message, activity, and note record to any authenticated user through an insecure direct object reference in the ChatterPanel Livewire component. Because the component resolved records with an unscoped Message::find($id) call instead of constraining the lookup to the parent record, an attacker holding nothing more than a low-privileged login (CVSS PR:L, no user interaction, no non-default configuration) can supply sequential message IDs to read, edit, delete, or pin messages belonging to other departments or companies and enumerate all notes in the system - an impact that is severe in multi-company or multi-department deployments where cross-tenant isolation is assumed. The assessed risk is a genuine, well-substantiated IDOR with high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; vendor-published CVSS 4.0 base 8.6), and no public exploit code was identified at time of analysis, although a public technical writeup of the issue is referenced. The vendor has released a fix in version 1.5.0.
Authenticated API users of Aureus ERP through 1.6.0 can create new records or move existing ones into companies they are not entitled to by submitting a foreign company_id to plugin REST endpoints, breaking the multi-company data segregation that the ERP relies on. The flaw is an IDOR/authorization bypass (CWE-639) in the Laravel Form Request validation of partners, sales, inventories, and accounts handlers, which checked only that the supplied company_id existed and never that it belonged to the caller's allowed companies; it is exploitable only by an authenticated account with API access and only on deployments that actually use more than one company. Rated 5.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, its real-world priority is moderate-to-low, patch code is available upstream, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user who can create or edit Inventory Operation Types and Location names to embed HTML/JavaScript in those fields, which are rendered without escaping by the Filament-based Rule form and infolist and then execute in the browser session of any warehouse manager or administrator who views or edits an affected Inventory Rule. The attack is not anonymous and not autonomous: the attacker must already hold an account with inventory-configuration permissions (CVSS PR:L), and the payload only fires once a privileged victim opens the affected screen (UI:R), limiting impact to actions available in that victim's session. Publicly available exploit code exists (a HackMD write-up is referenced), the issue is not listed in CISA KEV and shows no confirmed active exploitation, and the vendor fix is available upstream via pull request 1619.
Stored cross-site scripting in Aureus ERP versions before 1.6.0 allows an authenticated user who can edit at least one tracked text field to persist malicious markup inside the Chatter field-change log, which executes in the browser of any other user - including an administrator - who opens the affected record's Chatter panel. The vulnerability is rooted in Laravel Blade templates that render the change log's old_value and new_value entries with the unescaped {!! !!} directive rather than escaped {{ }} output, and it has been confirmed at the source-code level by the vendor's fix commit. Vendor-released patch: 1.6.0; no public exploit identified at time of analysis, though a public technical writeup of the issue exists. Risk is moderate (CVSS 4.0 base 5.1; independent assessment CVSS 3.1 5.1 with S:C) because exploitation requires prior authentication plus victim interaction, but the stored nature and administrator-targeting potential make it a credible privilege-escalation vector inside multi-user deployments.
Aureus ERP installations running the Webkul Chatter plugin before version 1.5.0 expose every message, activity, and note record to any authenticated user through an insecure direct object reference in the ChatterPanel Livewire component. Because the component resolved records with an unscoped Message::find($id) call instead of constraining the lookup to the parent record, an attacker holding nothing more than a low-privileged login (CVSS PR:L, no user interaction, no non-default configuration) can supply sequential message IDs to read, edit, delete, or pin messages belonging to other departments or companies and enumerate all notes in the system - an impact that is severe in multi-company or multi-department deployments where cross-tenant isolation is assumed. The assessed risk is a genuine, well-substantiated IDOR with high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; vendor-published CVSS 4.0 base 8.6), and no public exploit code was identified at time of analysis, although a public technical writeup of the issue is referenced. The vendor has released a fix in version 1.5.0.
Authenticated API users of Aureus ERP through 1.6.0 can create new records or move existing ones into companies they are not entitled to by submitting a foreign company_id to plugin REST endpoints, breaking the multi-company data segregation that the ERP relies on. The flaw is an IDOR/authorization bypass (CWE-639) in the Laravel Form Request validation of partners, sales, inventories, and accounts handlers, which checked only that the supplied company_id existed and never that it belonged to the caller's allowed companies; it is exploitable only by an authenticated account with API access and only on deployments that actually use more than one company. Rated 5.3 (CVSS 4.0) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, its real-world priority is moderate-to-low, patch code is available upstream, and no public exploit was identified at time of analysis.
Stored cross-site scripting in Aureus ERP through 1.6.0 allows an authenticated user who can create or edit Inventory Operation Types and Location names to embed HTML/JavaScript in those fields, which are rendered without escaping by the Filament-based Rule form and infolist and then execute in the browser session of any warehouse manager or administrator who views or edits an affected Inventory Rule. The attack is not anonymous and not autonomous: the attacker must already hold an account with inventory-configuration permissions (CVSS PR:L), and the payload only fires once a privileged victim opens the affected screen (UI:R), limiting impact to actions available in that victim's session. Publicly available exploit code exists (a HackMD write-up is referenced), the issue is not listed in CISA KEV and shows no confirmed active exploitation, and the vendor fix is available upstream via pull request 1619.
Stored cross-site scripting in Aureus ERP versions before 1.6.0 allows an authenticated user who can edit at least one tracked text field to persist malicious markup inside the Chatter field-change log, which executes in the browser of any other user - including an administrator - who opens the affected record's Chatter panel. The vulnerability is rooted in Laravel Blade templates that render the change log's old_value and new_value entries with the unescaped {!! !!} directive rather than escaped {{ }} output, and it has been confirmed at the source-code level by the vendor's fix commit. Vendor-released patch: 1.6.0; no public exploit identified at time of analysis, though a public technical writeup of the issue exists. Risk is moderate (CVSS 4.0 base 5.1; independent assessment CVSS 3.1 5.1 with S:C) because exploitation requires prior authentication plus victim interaction, but the stored nature and administrator-targeting potential make it a credible privilege-escalation vector inside multi-user deployments.