bagisto - Cross Site Scripting (XSS) in Create New Customer

The XSS vulnerability in Bagisto allows an attacker with access to the admin create-customer form to inject arbitrary JavaScript code. This code can execute within the context of an administrator's browser or any user viewing the customer data. The potential impact is significant. An attacker could steal administrator session cookies, gaining full control over the Bagisto admin panel. They could also modify customer data, inject malicious content onto the storefront, or redirect users to phishing sites. The blast radius extends to all users who can view customer data, and the potential for data exfiltration and system compromise is high. This type of XSS vulnerability is particularly dangerous because it can be exploited to escalate privileges and gain persistent access to the system.

1. Reserviert2025-10-13
2. Veröffentlicht2025-10-16
3. Geändert2025-10-17
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-62414 is to upgrade Bagisto to version 2.3.8 or later, which includes the fix for this vulnerability. If upgrading immediately is not feasible, consider implementing temporary workarounds. Input validation and sanitization on the admin create-customer form can help prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Review and restrict access to the admin panel, limiting it to authorized personnel only. After upgrading to 2.3.8, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload into the create-customer form and verifying that it does not execute.