A stored cross-site scripting vulnerability in MyCourts v3 poses a significant risk of session hijacking and unauthorized administrative access.

This is a stored XSS vulnerability triggered via the LTA number profile field. Any authenticated user can inject malicious scripts that execute when viewed by other users, including administrators, potentially leading to session token theft due to the absence of HttpOnly session cookie flags.

Successful exploitation allows an attacker to hijack user sessions, including those with administrative privileges. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential loss of data integrity within the application.

Immediate Action: Contact the vendor immediately to obtain and apply security updates that address this XSS flaw. If no patch is available, restrict access to profile editing features until a secure version is deployed.

Proactive Monitoring: Review application logs for anomalous script patterns or unexpected behavior within user profile fields. Monitor for suspicious administrative activity that may indicate a session hijacking event.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts. Use a Web Application Firewall (WAF) to detect and block common XSS payloads directed at the LTA number input field.

Public Exploit Available: Unknown

Organizations utilizing MyCourts v3 must treat this vulnerability with high priority due to the potential for administrative account takeover. Administrators should verify the current version of their deployment and apply all vendor-provided security patches immediately upon availability to mitigate the risk of cross-site scripting attacks.