| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| bagisto/bagisto | < 2.3.10 | 2.3.10 |
| bagisto | < 2.3.10 | 2.3.10 |
A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto 2.3.8 within the CMS page editor. Although the platform normally attempts to sanitize <script> tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited.
This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution.
Bagisto’s CMS editor includes an HTML sanitation mechanism intended to protect against script injection by wrapping raw script content in <div> elements. However, this mechanism is applied only to requests submitted through the UI. When the CMS update request is intercepted and modified at the HTTP level, the sanitation layer fails to strip or encode embedded <script> tags.
Because the back-end trusts the manipulated request, the malicious script is stored in the database exactly as submitted. When an administrator opens the CMS page (either in the editor or in the storefront), the JavaScript executes in the browser context with full admin privileges.
The vulnerability stems from insufficient server-side sanitization. Sanitization logic appears to rely on client-side or UI-layer controls, leaving the underlying HTTP endpoint unprotected.
By introducing unfiltered script content directly into the HTTP payload; bypassing the UI-level sanitization the CMS endpoint accepts and stores the malicious JS.
A video PoC has been prepared showing:
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャンImplement server-side sanitization (e.g., HTMLPurifier or Laravel Purifier) to strip or encode <script> tags regardless of how the request is manipulated.