| शीर्षक | CodeCanyon CRMGo SaaS 7.2 Stored Cross-Site Scripting (XSS) Vulnerabilities |
|---|
| विवरण | Vulnerability Summary:
Two critical stored Cross-Site Scripting (XSS) vulnerabilities were identified in CRMGo SaSS version 7.2. These vulnerabilities occur at two different endpoints (/deal/{note_id}/note and /project/task/{task_id}/show). An authenticated attacker with low privilege can inject malicious JavaScript into user-generated content (notes and comments), which is then stored and executed when other users, including administrators, view the affected pages. Successful exploitation allows attackers to steal sensitive data, impersonate users, and deploy phishing or malware attacks.
Vulnerable Endpoints:
/deal/{note_id}/note - Notes field in the Deals module.
/project/task/{task_id}/show - Comments section in Project Tasks.
Severity: High
Impact:
Phishing and malware deployment.
User impersonation through session theft.
Data leakage and potential full account compromise.
Step to reproduce:
Stored XSS 1
--------------------
Navigate to https://host/deal/list
View a deal, then in the Notes field, input the payload "<script>alert("stored")</script>, then save the Notes by clicking on "Add" button.
Stored XSS 2
---------------------
URL: https://host/project
Endpoint: /project/task/
Parameter: The comment parameter is vulnerable to stored XSS
1. View any task
2. On the left side, click on comment.
3. Use payload "<script>alert(5)</script>"
Credit: Jobyer Ahmed
Organization: Bytium |
|---|
| स्रोत | ⚠️ https://bytium.com/stored-xss-vulnerabilities-in-crmgo-saas-version-7-2/ |
|---|
| उपयोगकर्ता | suffer (UID 74855) |
|---|
| सबमिशन | 18/09/2024 04:53 PM (2 साल पहले) |
|---|
| संयम | 20/09/2024 07:57 AM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 278201 [CodeCanyon CRMGo SaaS तक 7.2 show comment क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|