| शीर्षक | PHPGurukul Small CRM 4.0 Cross Site Scripting |
|---|
| विवरण | Vulnerability: Stored Cross-Site Scripting (XSS)
Product: Small CRM in PHP (PHPGurukul)
Version: V 4.0
Vendor URL: https://phpgurukul.com/small-crm-php/
Description:
The "Name" field in registration.php and profile.php of Small CRM in PHP
(developed by PHPGurukul) does not sanitize user input before storing it
in the database, and does not encode output when rendering it back via
PHP's echo statement. This allows an authenticated or unauthenticated
user to inject arbitrary HTML/JavaScript that executes in the browser
of any user (including administrators) who views the affected page
(e.g. admin/manage-users.php).
Affected files:
- crm/registration.php
- crm/profile.php
Payload used:
<script>alert(document.cookie)</script>
Vulnerability class: CWE-79 (Improper Neutralization of Input During
Web Page Generation - Stored Cross-Site Scripting)
Disclosure timeline:
No response received during the reports |
|---|
| उपयोगकर्ता | chessredoffsec (UID 63008) |
|---|
| सबमिशन | 16/09/2026 03:53 AM (20 दिन पहले) |
|---|
| संयम | 05/10/2026 12:33 PM (19 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 322181 [PHPGurukul Small CRM 4.0 /registration.php username क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|