| tiêu đề | feelec-yishu feelcrm-os 1.0.0 Cross Site Scripting |
|---|
| Mô tả | FeelCRM 1.0.0 is affected by an authenticated stored cross-site scripting vulnerability in the CRM customer remark field. The `customer_form[remark]` parameter submitted to `POST /Crm/Customer/create` is HTML-encoded before storage, but the application later calls `htmlspecialchars_decode()` when reading textarea fields and renders the decoded value without output encoding in the customer detail page. An authenticated attacker with permission to create customers can store a payload such as `<img src=x onerror=alert(/xss/)>`; when an authorized CRM user views the affected customer's details, the payload executes in the application's origin. The supplied reproduction demonstrates successful execution through an alert displaying `/xss/`. The vulnerability requires an authenticated attacker who can create or modify customer records and an authenticated victim with permission to view the affected customer, and may allow access to data and CRM actions available to the victim's session. |
|---|
| Nguồn | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/3 |
|---|
| Người dùng | liaoxijun10086 (UID 101151) |
|---|
| Đệ trình | 14/09/2026 14:21 (cách đây 21 ngày) |
|---|
| Kiểm duyệt | 05/10/2026 00:44 (20 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 413470 [feelec-yishu feelcrm-os 1.0.0 Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode customer_form[remark] Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|