| Название | feelec-yishu feelcrm-os 1.0.0 Cross Site Scripting |
|---|
| Описание | FeelCRM 1.0.0 is affected by an authenticated stored cross-site scripting vulnerability in the CRM customer remark field. The `customer_form[remark]` parameter submitted to `POST /Crm/Customer/create` is HTML-encoded before storage, but the application later calls `htmlspecialchars_decode()` when reading textarea fields and renders the decoded value without output encoding in the customer detail page. An authenticated attacker with permission to create customers can store a payload such as `<img src=x onerror=alert(/xss/)>`; when an authorized CRM user views the affected customer's details, the payload executes in the application's origin. The supplied reproduction demonstrates successful execution through an alert displaying `/xss/`. The vulnerability requires an authenticated attacker who can create or modify customer records and an authenticated victim with permission to view the affected customer, and may allow access to data and CRM actions available to the victim's session. |
|---|
| Источник | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/3 |
|---|
| Пользователь | liaoxijun10086 (UID 101151) |
|---|
| Представление | 14.09.2026 14:21 (21 дни назад) |
|---|
| Модерация | 05.10.2026 00:44 (20 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 413470 [feelec-yishu feelcrm-os 1.0.0 Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode customer_form[remark] межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|