CVE-2026-8218: Devs Palace ERP Online XSS Vulnerability

CVE-2026-8218 Overview

CVE-2026-8218 is a cross-site scripting (XSS) vulnerability identified in Devs Palace ERP Online versions up to 4.0.0. The flaw resides in an unspecified function of the /inventory/purchase_return_save endpoint. An authenticated remote attacker can manipulate input handled by this endpoint to inject script content that executes in the context of another user's browser session. Public exploit details have been released, and the vendor did not respond to disclosure outreach. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact

Authenticated attackers can inject malicious script into the /inventory/purchase_return_save workflow, enabling session abuse, credential theft, or unauthorized actions within the ERP application.

Affected Products

• Devs Palace ERP Online versions up to and including 4.0.0
• Component: /inventory/purchase_return_save endpoint
• Vendor advisory: Not Available (vendor did not respond to disclosure)

Discovery Timeline

• 2026-05-10 - CVE-2026-8218 published to NVD
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8218

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting weakness in the inventory module of Devs Palace ERP Online. The affected endpoint, /inventory/purchase_return_save, accepts user-supplied input that is not properly neutralized before being rendered in the application's HTML output. When a victim user views the affected page, attacker-controlled script content executes in the victim's browser under the ERP application's origin.

Exploitation requires high privileges and user interaction, which constrains the practical attack surface. However, the integrity impact within the application context is meaningful because injected script can manipulate the rendered DOM, hijack form submissions, or exfiltrate session data accessible to the victim. The EPSS score for this issue is 0.032%, reflecting the limited exploitation observed at publication.

Root Cause

The root cause is missing or insufficient output encoding on data submitted through the purchase return save workflow. The application reflects or stores attacker-controlled input without applying contextual escaping for HTML, attribute, or JavaScript contexts. This is a classic [CWE-79] failure where the developer trusts input passed through internal workflows.

Attack Vector

The attack is launched over the network against an authenticated session with high privileges. An attacker submits crafted payload data through fields processed by /inventory/purchase_return_save. When a second user, such as an administrator or auditor reviewing the purchase return record, opens the affected view, the script executes in their browser. A public proof of concept has been published. See the VulDB entry #362435 and the Olografix PoC for technical details.

No verified code examples are available. The vulnerability mechanism is described in the references above.

Detection Methods for CVE-2026-8218

Indicators of Compromise

• HTTP POST requests to /inventory/purchase_return_save containing HTML tags, <script> markup, or JavaScript event handlers such as onerror= or onload= in form fields.
• Stored ERP records in the purchase return tables containing angle brackets, encoded script payloads, or javascript: URIs.
• Unexpected outbound requests from authenticated user browsers to attacker-controlled domains following access to inventory purchase return pages.

Detection Strategies

• Inspect web server access logs for parameter values in /inventory/purchase_return_save requests that contain script tags, encoded payloads, or unusual length spikes.
• Deploy web application firewall rules that match common XSS payload signatures targeting the inventory endpoint.
• Review database records in purchase return tables for stored markup that should not appear in business data fields.

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting to capture script execution violations originating from ERP pages.
• Correlate authentication logs with access patterns to /inventory/purchase_return_save to identify privileged accounts submitting unusual payloads.
• Alert on any new outbound domains contacted by browsers during ERP sessions, which may indicate data exfiltration via injected script.

How to Mitigate CVE-2026-8218

Immediate Actions Required

• Restrict access to the /inventory/purchase_return_save endpoint to only the minimum set of users who require purchase return functionality.
• Deploy a web application firewall in front of the ERP application with rules that block common XSS payloads targeting the affected endpoint.
• Audit existing purchase return records for stored markup and remove any malicious content found in the database.

Patch Information

No vendor patch is available. The vendor was contacted prior to disclosure but did not respond. Organizations running Devs Palace ERP Online 4.0.0 or earlier should treat this as an unpatched issue and apply compensating controls. Monitor the VulDB entry #362435 for any future vendor response or fix.

Workarounds

• Apply server-side output encoding by placing a reverse proxy or middleware that sanitizes responses containing data from purchase return fields.
• Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources to known origins.
• Limit privileged account use within the ERP to dedicated workstations that do not browse external content during active ERP sessions.
• Consider isolating the ERP application behind a VPN or zero-trust access proxy to reduce remote exposure.

# Example NGINX header configuration to enforce CSP for the ERP application
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;