smarttfoxx/cve-2025-67263Proof of concept for stored cross-site scripting (XSS) in Abacre Retail Point of Sale 14.0.0.396, demonstrating injection via Name and Surname fields in the Clients module.
Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, is persisted in the database.
The "Name" and "Surname" fields under the "Clients" tab are vulnerable to Stored Cross-Site Scripting (XSS).
By adding a simple payload such as <script>alert("xss 1")</script>, saving the user details in the database and then clicking 'Statement' the preview web page will trigger the XSS.
Since the payload gets stored in the database, it will be triggered every time that the 'Statement' button is clicked with the user selected.
