Summary

A Stored Cross-Site Scripting (XSS) vulnerability exists in the ticket reply
notification system. Unsanitized reply content is embedded directly into
database notifications and later rendered unescaped in the recipient's
browser, allowing an attacker to execute arbitrary JavaScript in the
victim's session context.

The vulnerability is present in both notification directions:

• App\Notifications\Ticket\Admin\AdminReplyNotification - triggered when
  a regular user replies to a ticket, targeting the admin's notification feed
• App\Notifications\Ticket\User\ReplyNotification - triggered when an
  admin replies to a ticket, targeting the user's notification feed

Details

When a ticket reply is submitted, the message content ($newmessage) is
stored in the database notification payload without sanitization. The
notification view renders this content using Blade's unescaped {!! !!}
syntax, which outputs raw HTML directly into the page.

When the recipient opens their notifications panel, any HTML or JavaScript
embedded in the reply executes immediately in their browser context.

PoC

Attack path: User -> Admin

1. Log in as a regular user.
2. Open any support ticket.
3. Post a reply with the following payload:

   <script>alert('XSS_POC')</script>

4. Log in as an administrator.
5. Click the notifications bell icon in the top navigation bar.
6. Result: the alert executes immediately in the admin's browser.

Attack path: Admin -> User

The same technique applies in reverse - an admin can inject a payload
via a ticket reply that executes in the target user's notification feed.

Impact

A low-privileged attacker can execute arbitrary JavaScript in an
administrator's browser context, enabling:

• Session hijacking - stealing the admin's session cookie to gain
  full administrative access
• Credential harvesting - injecting fake login prompts or keyloggers
• Privilege escalation - performing admin actions on behalf of the
  victim without their knowledge

The reverse path (admin -> user) allows a malicious or compromised admin
to target regular users in the same manner.

Remediation

Sanitize the message content before embedding it into the notification
payload. Since notification content is intended as a plain-text summary,
strip_tags() is sufficient to neutralize the injection.

Apply the fix to both affected notification classes:

• app/Notifications/Ticket/Admin/AdminReplyNotification.php
• app/Notifications/Ticket/User/ReplyNotification.php

- 'content' => "
-     <p>Ticket With ID : {$this->ticket->ticket_id} has had a new reply posted by <strong>{$this->user->name}</strong></p>
-     <br>
-     <p><strong>Message:</strong></p>
-     <p>{$this->newmessage}</p>
- ",
+ 'content' => "
+     <p>Ticket With ID : {$this->ticket->ticket_id} has had a new reply posted by <strong>{$this->user->name}</strong></p>
+     <br>
+     <p><strong>Message:</strong></p>
+     <p>" . strip_tags($this->newmessage) . "</p>
+ ",