Devansh Sanghvi

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

**Name of the Vulnerable Software and Affected Versions** Aureus ERP versions prior to 1.6.1 **Description** The Accounting plugin fails to sanitize the Payment Term note field, rendering it as raw HTML. Authenticated users with payment-term create permissions can submit arbitrary JavaScript to the `payment-terms` endpoint. This script is stored in the database and executes in the browsers of all users who view the affected Payment Term record, leading to a stored Cross-Site Scripting (XSS) condition. **Recommendations** Update to a version newer than 1.6.0. Restrict access to the `payment-terms` endpoint for users who do not strictly require payment-term creation permissions.