OPEXUS eComplaint and eCASE Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in OPEXUS eComplaint and eCASE versions prior to 10.2.0.0. The issue arises because these applications do not properly sanitize the 'Name of Organization' field when case information is being entered. This lack of proper input validation allows authenticated attackers to inject XSS payloads, which are then executed in the context of the victim's session when they access the case information page.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's session.

Remediation

Users can upgrade to OPEXUS eComplaint or eCASE version 10.2.0.0 or later to address this vulnerability.