{"id":38337,"date":"2025-04-04T04:26:56","date_gmt":"2025-04-03T22:56:56","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=38337"},"modified":"2025-04-04T04:26:59","modified_gmt":"2025-04-03T22:56:59","slug":"cve-2024-53569stored-cross-site-scripting-xss-in-volmarg-personal-management-system","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/vulnerability\/cve-2024-53569stored-cross-site-scripting-xss-in-volmarg-personal-management-system\/","title":{"rendered":"CVE-2024-53569:Stored Cross-Site Scripting (XSS) in Volmarg Personal Management System"},"content":{"rendered":"
\n\n

Product Name:<\/strong>\u00a0Volmarg Personal Management System
Vulnerability:<\/strong>\u00a0Stored Cross-Site Scripting (XSS)
Vulnerable Version:\u00a0<\/strong>v1.4.65
CVE:<\/strong>\u00a0CVE-2024-53569<\/p>\n\n<\/div>\n\n\n

The researchers from Astra\u2019s security team, on March 06, 2025, discovered a stored cross-site scripting (XSS) vulnerability in the Volmarg Personal Management System v1.4.65. The vulnerability was identified in the “Description” field on the “Add Goal” page, where improper validation of user input allowed attackers to inject malicious scripts.<\/p>\n\n\n\n

A stored XSS vulnerability occurs when an application allows user-supplied input to be stored without proper sanitization, making it accessible to other users. This enables attackers to execute arbitrary JavaScript or HTML within the victim\u2019s browser, leading to session hijacking, data theft, and other malicious activities.<\/p>\n\n\n\n

<\/span>Technical Breakdown<\/span><\/h2>\n\n\n\n

How was it discovered?<\/strong><\/h3>\n\n\n\n

The vulnerability originates from the lack of input validation in the “Description” field of the “Add Goal” page. Researchers identified that the application fails to sanitize user-supplied content before rendering it back to users.<\/p>\n\n\n\n

How to recreate this vulnerability?<\/strong><\/h3>\n\n\n\n
    \n
  1. Login<\/strong> to the Demo Web Application.<\/li>\n\n\n\n
  2. Navigate<\/strong> to the “List” option under the “Goals” menu from the navigation panel.<\/li>\n\n\n\n
  3. Click<\/strong> the “+” button to add a new goal.<\/li>\n\n\n\n
  4. Enter<\/strong> an XSS payload into the “Description” field and provide any random value in the “Name” field.<\/li>\n\n\n\n
  5. Submit<\/strong> the form by clicking the “SUBMIT” button.<\/li>\n\n\n\n
  6. Traverse<\/strong> to the “Dashboard” page and observe that an alert is triggered based on the injected payload.<\/li>\n<\/ol>\n\n\n\n

    <\/span>Impact of Stored XSS Vulnerability<\/span><\/h2>\n\n\n\n

    The severity of this vulnerability is classified as Critical<\/strong> due to its potential impact:<\/p>\n\n\n\n