MajorDoMo's /objects/?op=set endpoint accepts user-supplied property values without sanitization and stores them raw in the database. These values are later rendered in the admin panel without escaping in both paragraph and textarea elements, causing stored XSS that executes automatically when an administrator views the property editor. The session cookie is missing the HttpOnly flag, which allows JavaScript access to the cookie and potential session hijacking. Additionally, the unauthenticated /api.php/data/ endpoint allows attackers to enumerate and modify properties, facilitating injection of malicious scripts. This vulnerability affects version 0 of MajorDoMo and has a CVSS 4.0 score of 5.3 (medium severity). No patch or remediation information is provided.

An attacker can exploit the stored XSS vulnerability to execute arbitrary JavaScript in the context of the administrator's browser without requiring interaction beyond page load. This can lead to session hijacking due to the absence of the HttpOnly flag on the session cookie. The unauthenticated API endpoint allows attackers to enumerate and poison properties, increasing the attack surface. The overall impact is medium severity, potentially allowing unauthorized access or control over the admin session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints, especially the unauthenticated /objects/?op=set and /api.php/data/ endpoints, to trusted networks or users. Implement web application firewall (WAF) rules to detect and block malicious input targeting these endpoints. Consider manually sanitizing inputs or filtering property values before storage if possible. Enable HttpOnly flag on session cookies to prevent JavaScript access. Monitor vendor channels for official patches or updates.