Executive brief
A security vulnerability exists in Devs Palace ERP Online, a business management software suite. An attacker with high-level administrative privileges could inject malicious scripts into the system's accounting module. If another user views the affected area, the script could execute in their browser, potentially leading to unauthorized actions or data manipulation within the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Devs Palace ERP Online up to version 4.0.0. The flaw is located within the /accounts/chart-save file, where improper input neutralization allows for the injection of malicious web scripts. An attacker requires high privileges (PR:H) and network access to exploit this vulnerability. Successful exploitation requires a victim to interact with the manipulated page (UI:R), at which point the script executes in the context of the victim's session. A public proof-of-concept exists, and the vendor has reportedly not responded to disclosure attempts.
Affected products
- Devs Palace ERP Online up to 4.0.0
Timeline
- 2026-05-11: disclosed: Initial public disclosure via VulDB and NVD
- 2026-05-11: advisory
