Executive brief
Otalio's Ship Property Management System (SPMS) is used by cruise lines and maritime operators to manage guest services, onboard operations, and revenue across their fleets. A vulnerability in the application security page allows authenticated users with administrative privileges to inject malicious scripts that execute when other users view that page, potentially enabling account takeover and unauthorized data access without requiring additional authentication.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the SPMS application security page that fails to properly escape user-supplied input before displaying it on the page. An authenticated attacker with high privileges can inject a malicious JavaScript payload (up to 2000 characters) that persists in the application. When another user with administrative access navigates to the application security page, the injected script executes in their browser context. The exploit chain demonstrated account takeover by leveraging a missing password verification check—allowing an attacker to change a victim user's password without knowing the current password. Missing Content-Security-Policy headers further enabled the exploit. The vulnerability requires authentication and administrative privileges but does not require user interaction beyond normal page navigation. A patch is available in version 2.22.0 and later.
Affected products
- Otalio Ship Property Management System before 2.22.0
Timeline
- 2025-06-05: disclosed: Issue reported to Otalio
- 2025-06-05: other: Issue confirmed by Otalio
- 2025-12-08: other: Otalio completes developing patch
- 2026-08-18: advisory: Mandiant advisory and CVE published