Executive brief
money-pos is a point-of-sale system used to manage orders, payments, and returns. A stored XSS vulnerability in the order returns process allows an attacker with product creation privileges to inject malicious JavaScript that executes when administrators view order logs, potentially leading to unauthorized actions or data theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the order return handling logic. The backend (OmsOrderServiceImpl.java) concatenates user-controlled product names (goodsName parameter) directly into order log descriptions without HTML escaping. The frontend then renders this log description using Vue's v-html directive, which bypasses Vue's XSS protections and executes injected JavaScript. An attacker with product creation privileges can inject a payload like "测<img src=x onerror=alert(1)>" that persists in the database and executes when an administrator views the affected order logs. The fix requires HTML escaping on the backend using HtmlUtils.htmlEscape() or switching to safe text interpolation on the frontend.
Affected products
- ycf1998 money-pos 1.0
Timeline
- 2026-07-23: disclosed: Vulnerability reported on GitHub
- 2026-09-09: advisory: CVE-2026-71803 published