| タイトル | feelec-yishu feelcrm-os 1.0.0 Cross Site Scripting |
|---|
| 説明 | FeelCRM 1.0.0 is affected by an authenticated stored cross-site scripting vulnerability in the CRM customer remark field. The `customer_form[remark]` parameter submitted to `POST /Crm/Customer/create` is HTML-encoded before storage, but the application later calls `htmlspecialchars_decode()` when reading textarea fields and renders the decoded value without output encoding in the customer detail page. An authenticated attacker with permission to create customers can store a payload such as `<img src=x onerror=alert(/xss/)>`; when an authorized CRM user views the affected customer's details, the payload executes in the application's origin. The supplied reproduction demonstrates successful execution through an alert displaying `/xss/`. The vulnerability requires an authenticated attacker who can create or modify customer records and an authenticated victim with permission to view the affected customer, and may allow access to data and CRM actions available to the victim's session. |
|---|
| ソース | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/3 |
|---|
| ユーザー | liaoxijun10086 (UID 101151) |
|---|
| 送信 | 2026年09月14日 14:21 (21 日 ago) |
|---|
| モデレーション | 2026年10月05日 00:44 (20 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413470 [feelec-yishu feelcrm-os 1.0.0 Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode customer_form[remark] クロスサイトスクリプティング] |
|---|
| ポイント | 20 |
|---|