CVE-2026-8220: Devs Palace ERP Online XSS Vulnerability

CVE-2026-8220 Overview

CVE-2026-8220 is a cross-site scripting (XSS) vulnerability affecting Devs Palace ERP Online versions up to and including 4.0.0. The flaw resides in an unspecified function within the /inventory/customer-save endpoint. Attackers can inject malicious script content through manipulated input that reaches the affected component. The attack is exploitable remotely over the network, though it requires high privileges and user interaction. A public proof-of-concept exists, but the vendor did not respond to early disclosure attempts. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can inject persistent or reflected JavaScript through the /inventory/customer-save endpoint, enabling session manipulation and limited integrity loss within the ERP interface.

Affected Products

Devs Palace ERP Online versions up to 4.0.0
The vendor (Devs Palace) did not respond to disclosure outreach
No patched version has been published at the time of disclosure

Discovery Timeline

2026-05-10 - CVE-2026-8220 published to NVD
2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8220

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw in the /inventory/customer-save handler of Devs Palace ERP Online. The application fails to neutralize special characters in user-supplied input before returning it within HTML output. An authenticated user with high privileges can submit crafted payloads through the customer-save workflow, which then execute in the browser of any user who renders the affected view. According to the public disclosure on VulDB #362437, the exploit requires user interaction to trigger the malicious payload. The EPSS probability is 0.03%, indicating low predicted exploitation activity in the near term.

Root Cause

The root cause is improper output encoding and input sanitization in the customer-save handler. The application accepts arbitrary characters including <, >, and quote characters in customer record fields. These characters are persisted and later rendered into HTML responses without contextual escaping. This pattern aligns with the standard [CWE-79] class of issues where untrusted input flows directly into a web response.

Attack Vector

An attacker requires an authenticated session with elevated privileges to submit a record through /inventory/customer-save. The attacker places a JavaScript payload into a vulnerable field within the customer save form. When another user with access to the affected ERP view loads the rendered page, the injected script executes within their browser context. The script can read cookies accessible to the page, perform actions on behalf of the victim, or modify the displayed interface. A public proof-of-concept demonstrating the exploit is hosted in the Olografix PoC Repository.

No verified code examples are available for inclusion. Reviewers should consult the linked PoC and VulDB CTI entry for additional technical context.

Detection Methods for CVE-2026-8220

Indicators of Compromise

HTTP POST requests to /inventory/customer-save containing HTML or JavaScript metacharacters such as <script>, onerror=, or javascript: in form fields
Unexpected outbound browser requests originating from ERP user sessions to external domains
Customer records in the ERP database containing unescaped HTML tags or event-handler attributes

Detection Strategies

Inspect web server access logs for POST requests to /inventory/customer-save with payloads containing common XSS markers
Apply web application firewall signatures targeting XSS payloads on the inventory and customer endpoints
Audit stored customer records for HTML tags, encoded script fragments, or suspicious event handlers

Monitoring Recommendations

Enable verbose logging on the ERP application reverse proxy and capture full request bodies for inventory endpoints
Monitor browser-side Content Security Policy (CSP) violation reports if CSP headers are deployed
Alert on authenticated sessions submitting payloads that match XSS heuristics, particularly from high-privilege accounts

How to Mitigate CVE-2026-8220

Immediate Actions Required

Restrict access to the /inventory/customer-save endpoint to trusted, audited accounts only
Review and sanitize existing customer records for stored payloads before continued use
Deploy a web application firewall rule that blocks HTML and JavaScript metacharacters in customer-save form fields

Patch Information

No official patch is available. The vendor was contacted prior to disclosure but did not respond. Organizations running Devs Palace ERP Online 4.0.0 or earlier should monitor the vendor channels and apply compensating controls until a fix is released.

Workarounds

Place the ERP application behind a reverse proxy that enforces input validation on customer-save fields
Enforce a strict Content Security Policy that disallows inline script execution within the ERP interface
Reduce the number of high-privilege accounts able to write customer records, lowering exposure to authenticated XSS
Train ERP users to avoid clicking links or rendering records from untrusted sources within the application

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on the affected endpoint
SecRule REQUEST_URI "@beginsWith /inventory/customer-save" \
    "id:1026822,phase:2,deny,status:403,\
     msg:'Potential XSS payload on customer-save endpoint (CVE-2026-8220)',\
     chain"
    SecRule ARGS "@rx (?i)(<script|onerror=|javascript:|<img[^>]+src=)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"