| 제목 | feelec-yishu feelcrm-os 1.0.0 Cross Site Scripting |
|---|
| 설명 | FeelCRM 1.0.0 is affected by an authenticated stored cross-site scripting vulnerability in the CRM customer remark field. The `customer_form[remark]` parameter submitted to `POST /Crm/Customer/create` is HTML-encoded before storage, but the application later calls `htmlspecialchars_decode()` when reading textarea fields and renders the decoded value without output encoding in the customer detail page. An authenticated attacker with permission to create customers can store a payload such as `<img src=x onerror=alert(/xss/)>`; when an authorized CRM user views the affected customer's details, the payload executes in the application's origin. The supplied reproduction demonstrates successful execution through an alert displaying `/xss/`. The vulnerability requires an authenticated attacker who can create or modify customer records and an authenticated victim with permission to view the affected customer, and may allow access to data and CRM actions available to the victim's session. |
|---|
| 원천 | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/3 |
|---|
| 사용자 | liaoxijun10086 (UID 101151) |
|---|
| 제출 | 2026. 09. 14. PM 02:21 (21 날 ago) |
|---|
| 모더레이션 | 2026. 10. 05. AM 12:44 (20 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413470 [feelec-yishu feelcrm-os 1.0.0 Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode customer_form[remark] 크로스 사이트 스크립팅] |
|---|
| 포인트들 | 20 |
|---|