CVE-2024-53568:Stored Cross-Site Scripting (XSS) Vulnerability in Volmarg Personal Management System

The researchers from Astra’s security team, on March 06, 2025, discovered a stored cross-site scripting (XSS) vulnerability in Volmarg Personal Management System v1.4.65. The issue was identified in the “Tags” field on the “Image Upload” page, where improper user input validation allowed attackers to execute arbitrary scripts.

A stored XSS vulnerability occurs when an application stores malicious user input without proper sanitization, making it accessible to other users and potentially leading to session hijacking or data theft.

Technical Breakdown

How Was It Discovered?

Astra’s security researchers identified this vulnerability while analyzing user input handling on the “Image Upload” page. The “Tags” field allowed unrestricted input, which was later reflected on the “Main Folder” page without proper encoding or sanitization. This flaw enabled JavaScript execution in the victim’s browser, leading to a successful XSS attack.

How To Recreate This Vulnerability?

1. Login to the Demo Web Application.
2. Navigate to the “Upload” option in the left-hand navigation panel and select “Add.”
3. Click on the “Folder” button to open the file selection dialog.
4. Choose a random image file and click “Open.”
5. Enter an XSS payload into the “Tags” field and click “UPLOAD.”
6. Navigate to the “Main Folder” page listed under the “Images” drop-down and observe that the injected payload is executed, triggering an alert.

Impact of the Stored XSS Vulnerability

The severity of this vulnerability is critical, as it can be exploited to:

• Compromise User Sessions: Attackers can steal session cookies, leading to session hijacking and unauthorized access.
• Execute Malicious Scripts: Arbitrary JavaScript can be injected and executed in the context of other users’ sessions.
• Deface the Application: Attackers can modify page content, misleading users and damaging the system’s integrity.
• Phishing Attacks: Users can be tricked into providing sensitive information through fake forms injected via XSS.

Current Status

The vulnerability was discovered in the “Tags” field on the “Image Upload” page of Volmarg Personal Management System v1.4.65. The issue has been reported to the developers, and remediation steps are advised to mitigate the risk.

What Can You Do?

To avoid potential exploitation, users are strongly advised to update Volamarg PMS to the latest version, which includes essential security patches.