Stored XSS in OpenCATS MRU (Recent) Navigation Panel

Root Cause

MRU::getFormatted() reads dataItemText verbatim from the mru table and interpolates it directly into an HTML anchor tag without calling htmlspecialchars() or Template::escapeHtml(). The value originates from unsanitized record name/title fields (Candidate/Contact name, Company name, Job Order title, List name) written via addEntry() at the call sites above. printQuickSearch() echoes this output directly and is invoked from approximately 77 template files, rendering on nearly every authenticated page.

Impact

An attacker holding only a low-privileged account (Access Level 200, Add/Edit) can execute arbitrary JavaScript in the browser session of any other user who views a record they created or edited, including Site Administrators (Access Level 500). This enables session/cookie theft, silent creation of new admin accounts, and exfiltration of confidential candidate/company data, providing a privilege escalation path from a standard Add/Edit role to full administrative control. No CSRF bypass or social engineering beyond a legitimate business user opening a normal record is required. The payload persists in the victim's own MRU history, rendered on roughly 77 different pages/templates, until enough newer items push it out.

Remediation

OpenCATS now escapes MRU display text at the HTML output boundary before it is inserted into the Recent/MRU navigation. The fix reuses the existing Template::escapeHtml() helper in MRU::getFormatted() after the existing MRU_ITEM_LENGTH truncation logic has been applied. Record names and titles continue to be stored unchanged in the database. No additional encoding is performed in MRU::addEntry(), avoiding double-encoding and ensuring values remain available for other output contexts. No changes were made to MRU URL generation or record creation/editing behaviour.