| 标题 | feelec-yishu feelcrm-os 1.0.0 Cross Site Scripting |
|---|
| 描述 | FeelCRM 1.0.0 is affected by an authenticated stored cross-site scripting vulnerability in the CRM customer remark field. The `customer_form[remark]` parameter submitted to `POST /Crm/Customer/create` is HTML-encoded before storage, but the application later calls `htmlspecialchars_decode()` when reading textarea fields and renders the decoded value without output encoding in the customer detail page. An authenticated attacker with permission to create customers can store a payload such as `<img src=x onerror=alert(/xss/)>`; when an authorized CRM user views the affected customer's details, the payload executes in the application's origin. The supplied reproduction demonstrates successful execution through an alert displaying `/xss/`. The vulnerability requires an authenticated attacker who can create or modify customer records and an authenticated victim with permission to view the affected customer, and may allow access to data and CRM actions available to the victim's session. |
|---|
| 来源 | ⚠️ https://github.com/feelec-yishu/feelcrm-os/issues/3 |
|---|
| 用户 | liaoxijun10086 (UID 101151) |
|---|
| 提交 | 2026-09-14 14時21分 (21 日前) |
|---|
| 管理 | 2026-10-05 00時44分 (20 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 413470 [feelec-yishu feelcrm-os 1.0.0 Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode customer_form[remark] 跨网站脚本] |
|---|
| 积分 | 20 |
|---|