Stored XSS in Otalio Ship Property Management System

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Otalio's Ship Property Management System (SPMS) versions before 2.22.0. Unescaped stored values in the application security page allow authenticated attackers to inject malicious scripts that persist in the system. When a privileged user views the page, the script executes, enabling privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

Check for unpatched versions of Otalio Ship Property Management System below 2.22.0. Inspect the Application Security page for stored XSS payloads in user inputs. Monitor network traffic for unusual script injections or privilege escalation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform account takeover by changing a user's password without knowing the current password. This may lead to impersonation, session hijacking, or unauthorized access to sensitive data. The attacker needs to submit an XSS payload and wait for a privileged user to interact with the vulnerable page.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to SPMS version 2.22.0 or later immediately. Implement strict input validation for all user inputs. Add Content-Security-Policy headers to block XSS attacks. Review and remove any suspicious stored XSS payloads in the Application Security page.

Useful 0 Not Useful 0