CyberRota Analysis
AI-GeneratedBagisto versions prior to 2.4.4 are vulnerable to a stored cross-site scripting attack due to improper handling of user input in customer name fields, enabling unauthenticated attackers to inject malicious JavaScript that executes in administrator browsers. This vulnerability arises from the lack of the Vue.js v-pre directive in the create.blade.php template, allowing the execution of arbitrary scripts when an administrator views the Create Order page for the compromised account. Organizations using affected versions of Bagisto should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.