CVE-2026-8256: Devs Palace ERP Online XSS Vulnerability

CVE-2026-8256 Overview

CVE-2026-8256 is a cross-site scripting (XSS) vulnerability affecting Devs Palace ERP Online versions up to 4.0.0. The flaw resides in unknown code within the /accounts/mr-save endpoint, where insufficient input sanitization allows attackers to inject arbitrary script content [CWE-79]. The vulnerability is exploitable remotely over the network and requires high privileges along with user interaction. The exploit has been disclosed publicly. According to the disclosure, the vendor was contacted prior to publication but did not respond.

Critical Impact

Authenticated attackers can inject malicious scripts through the /accounts/mr-save endpoint, enabling session-context script execution in victim browsers when they interact with crafted content.

Affected Products

• Devs Palace ERP Online versions up to and including 4.0.0
• The vulnerable component is the /accounts/mr-save handler
• No vendor-supplied affected-product CPE list is currently published in NVD

Discovery Timeline

• 2026-05-11 - CVE-2026-8256 published to the National Vulnerability Database
• 2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8256

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting issue [CWE-79] in the /accounts/mr-save endpoint of Devs Palace ERP Online. The application fails to properly neutralize user-controlled input before it is rendered in the resulting web page. An authenticated attacker with high privileges can submit crafted payloads containing HTML or JavaScript that the application later serves to other users.

Exploitation requires user interaction, meaning the victim must navigate to or interact with the affected page for the payload to execute. Once triggered, the script runs in the victim's browser within the security context of the ERP application. This can be abused to read or modify content visible to the user, perform actions on their behalf, or exfiltrate session-bound data. The disclosed exploit is publicly available, increasing the likelihood of opportunistic abuse against unpatched deployments.

Root Cause

The root cause is improper neutralization of input during web page generation in the /accounts/mr-save handler. User-supplied parameters are not encoded or sanitized before being reflected back into the HTML response, allowing script tags or event handler attributes to break out of the intended data context.

Attack Vector

The attack vector is network-based. An authenticated attacker submits a request to /accounts/mr-save containing malicious markup in one or more parameters. When a privileged user views the affected resource, the injected script executes in their browser session. See the Olografix PoC Image and the VulDB Vulnerability #362553 entry for technical details.

Detection Methods for CVE-2026-8256

Indicators of Compromise

• HTTP POST requests to /accounts/mr-save containing <script>, onerror=, onload=, or javascript: substrings in body parameters
• Stored ERP records whose text fields contain unescaped HTML tags or event handler attributes
• Unexpected outbound requests from authenticated user browsers to attacker-controlled domains shortly after viewing account pages

Detection Strategies

• Inspect web server and application logs for requests to /accounts/mr-save containing HTML or JavaScript metacharacters such as <, >, ", ', and =
• Deploy a web application firewall rule that flags script-injection patterns targeting the vulnerable endpoint
• Review the ERP database for stored fields that contain raw HTML markup inconsistent with expected business data

Monitoring Recommendations

• Enable Content Security Policy (CSP) reporting to capture script violations originating from ERP pages
• Alert on authentication sessions that issue unusual sequences of /accounts/mr-save requests
• Correlate browser-side script errors with server-side write operations to identify successful payload delivery

How to Mitigate CVE-2026-8256

Immediate Actions Required

• Restrict access to the /accounts/mr-save endpoint to trusted administrative networks where feasible
• Audit existing ERP records for previously stored malicious payloads and sanitize them
• Review privileged account activity in Devs Palace ERP Online for signs of abuse, since exploitation requires high privileges

Patch Information

At the time of publication, no vendor patch or fixed version has been published for Devs Palace ERP Online. The disclosure notes the vendor did not respond to outreach. Monitor the VulDB Vulnerability #362553 entry and the vendor's official channels for updates.

Workarounds

• Place the ERP application behind a web application firewall configured to block XSS payloads targeting /accounts/mr-save
• Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to known origins
• Limit the number of accounts with high privileges, since the vulnerability requires PR:H to exploit
• Educate privileged users to avoid interacting with suspicious ERP records pending a vendor fix

# Example NGINX snippet to add a restrictive CSP header in front of the ERP app
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;