| Titolo | ChangeWeDer crm 0.0.1-SNAPSHOT xss |
|---|
| Descrizione | Description
The ChangeWeDer crm application contains a stored Cross-Site Scripting (XSS) vulnerability.
User-controlled input is stored by the application without adequate input filtering and is later rendered without proper HTML output encoding.
An attacker can submit a malicious JavaScript payload through the affected customer-name fields. The payload is stored by the application and executed when the affected data is subsequently rendered.
Proof of Concept
The vulnerability was reproduced locally through /sale_chance/save.
Example request:
POST /sale_chance/save HTTP/1.1
Host: localhost:8080
Cookie: userId=<valid-user-id>; userName=admin; trueName=admin
Content-Type: application/x-www-form-urlencoded
customerName=<XSS_PAYLOAD>&linkMan=test&linkPhone=13800138000&overview=test&description=test&successPossibility=50
The supplied payload is stored and is executed when the corresponding stored customer data is rendered.
The same class of vulnerability was identified in /customer_serve/save.
Attack Prerequisites
An authenticated user account capable of submitting the affected form data.
Impact
Successful exploitation allows persistent JavaScript execution in the context of users viewing the affected stored data.
Depending on the privileges of the victim, this may result in unauthorized actions performed through the victim's browser or compromise of application-side user interactions.
Root Cause
The application does not adequately neutralize attacker-controlled input before storing it and does not apply appropriate output encoding when rendering the affected data.
Remediation
Apply context-appropriate HTML output encoding when rendering user-controlled data.
Validate input according to the expected data format.
Do not rely solely on client-side filtering.
Apply the same protection consistently to all affected fields and endpoints.
References
GitHub Issue #4:
https://github.com/ChangeWeDer/crm/issues/4 |
|---|
| Fonte | ⚠️ https://github.com/ChangeWeDer/crm/issues/4 |
|---|
| Utente | mjh_123 (UID 92618) |
|---|
| Sottomissione | 20/08/2026 15:36 (27 giorni fa) |
|---|
| Moderazione | 16/09/2026 11:41 (27 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 405596 [ChangeWeDer crm fino a c07bd4c97141521af6475034bc58523beed51bbd Save Endpoint customer.serve.js customerName cross site scripting] |
|---|
| Punti | 20 |
|---|