Stored XSS in Bacularis Client Address Field

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Bacularis versions 1.0.0 through 6.5.0. It allows attackers to inject malicious JavaScript payloads into the client address field, which are then stored and executed when other users view client details.

Useful 0 Not Useful 0

Detection Guidance

Check Bacularis version with: bacularis --version. If running 1.0.0 to 6.5.0, inspect client address fields for XSS payloads like <script> tags. Review logs for unusual client creation events.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this by adding a client with an XSS payload in the address field. When users click the Details button for that client, the payload executes, potentially stealing session cookies, redirecting users, or performing actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

Stored XSS vulnerabilities like CVE-2026-88742 can lead to unauthorized data access or modification, which may violate GDPR's data protection requirements if personal data is exposed. For HIPAA, such vulnerabilities could risk protected health information integrity if exploited in healthcare systems.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Bacularis to version 6.5.1 or later immediately. Remove any suspicious clients with XSS payloads in the address field. Restrict user permissions to minimize exposure.

Useful 0 Not Useful 0