CVE-2026-8253: Devs Palace ERP Online XSS Vulnerability

CVE-2026-8253 Overview

CVE-2026-8253 is a cross-site scripting (XSS) vulnerability in Devs Palace ERP Online versions up to 4.0.0. The flaw resides in the /inventory/purchase_save endpoint, where unsanitized input is reflected back to users. An authenticated attacker with high privileges can inject arbitrary script content into the application. The vulnerability is classified under [CWE-79] and is exploitable over the network. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated attackers can inject malicious scripts through the /inventory/purchase_save endpoint, enabling session-context script execution against other ERP users.

Affected Products

• Devs Palace ERP Online versions up to and including 4.0.0
• Component: /inventory/purchase_save endpoint
• Deployments exposing the ERP web interface to network-reachable clients

Discovery Timeline

• 2026-05-11 - CVE-2026-8253 published to NVD
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8253

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting flaw in the inventory module of Devs Palace ERP Online. The /inventory/purchase_save handler accepts user-controlled input and includes it in HTTP responses without proper output encoding or input sanitization. When another authenticated user views the affected page, the injected payload executes in their browser within the ERP application's origin.

Exploitation requires authentication with high privileges and user interaction with the injected content. The impact is limited to integrity within the user's browser session. Confidentiality and availability of the ERP system itself are not directly affected, though session tokens or UI state can be manipulated.

Root Cause

The root cause is missing or insufficient neutralization of script-bearing input during web page generation [CWE-79]. The purchase_save action does not apply context-appropriate encoding before reflecting user-supplied parameters into HTML output.

Attack Vector

An authenticated attacker submits a crafted request to /inventory/purchase_save containing script content in a vulnerable parameter. When the application renders the resulting data back into a page viewed by another user, the script executes. Refer to the Olografix PoC Repository and VulDB Vulnerability #362550 for technical details.

Detection Methods for CVE-2026-8253

Indicators of Compromise

• HTTP POST requests to /inventory/purchase_save containing <script>, onerror=, onload=, or javascript: tokens in parameter values
• Inventory or purchase records containing HTML tags, encoded angle brackets, or event-handler attributes
• Unexpected outbound requests from ERP user browsers to attacker-controlled domains following inventory page views

Detection Strategies

• Inspect web server and application logs for requests to /inventory/purchase_save with payloads matching common XSS signatures
• Review stored inventory and purchase data for HTML or JavaScript content that should not appear in normal business records
• Monitor browser-side Content Security Policy (CSP) violation reports if CSP headers are deployed

Monitoring Recommendations

• Enable verbose request logging on the ERP application server, including request bodies for state-changing endpoints
• Alert on administrative or high-privilege account activity that submits markup-bearing input to inventory endpoints
• Correlate authentication events with subsequent access to inventory views by other users to identify potential victims

How to Mitigate CVE-2026-8253

Immediate Actions Required

• Restrict access to the Devs Palace ERP Online web interface to trusted networks or VPN users until a fix is available
• Audit user accounts with high privileges and remove unnecessary elevated access to limit the pool of potential attackers
• Review existing inventory and purchase records for previously injected script content and sanitize stored data

Patch Information

No vendor patch has been published. The vendor was contacted prior to disclosure but did not respond, according to the VulDB advisory for vulnerability #362550. Organizations should monitor Devs Palace channels for an updated release beyond version 4.0.0.

Workarounds

• Deploy a web application firewall (WAF) rule that blocks HTML tag and event-handler patterns in requests to /inventory/purchase_save
• Add a strict Content Security Policy header to the ERP application to restrict inline script execution
• Implement reverse-proxy input filtering that rejects requests containing <script, onerror=, or javascript: substrings targeting the inventory module
• Limit the number of accounts holding the high-privilege role required for exploitation