Executive brief
The CodeAstro Complaint Management System, a web application used for tracking and managing user grievances, contains a security flaw in its reporting module. An attacker with a standard user account can submit a report containing malicious code that will run in the browser of an administrator who views the report. This could allow the attacker to perform unauthorized actions on behalf of the administrator or potentially take over administrative accounts.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CodeAstro Complaint Management System 1.0 within the Report Handler component. The application fails to sanitize user-supplied input in the 'Report Title' argument at the /report/addreport endpoint. When a low-privileged authenticated user submits a report with a malicious payload, the script is stored in the database and later rendered without proper output encoding in the administrative report management panel. An attacker can exploit this to execute arbitrary JavaScript in the context of an administrator's session, potentially leading to session hijacking or privilege escalation. A public exploit involving an SVG onload event has been disclosed.
Affected products
- CodeAstro Complaint Management System 1.0
Timeline
- 2026-06-29: disclosed: Initial disclosure via VulDB and NVD
- 2026-06-29: advisory