Perfex - Powerful Open Source CRM v2.3.4 Stored XSS Injection

2019.04.25
ru QUIXSS (RU) ru
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

[*] :: Title: Perfex - Powerful Open Source CRM v2.3.4 Stored XSS Injection [*] :: Author: QUIXSS [*] :: Date: 2019-04-25 [*] :: Software: Perfex - Powerful Open Source CRM v2.3.4 [?] :: Technical Details & Description: # Weak security measures like bad input fields data filtering has been discovered in the «Perfex - Powerful Open Source CRM». Current version of this web-application is 2.3.4. [?] :: Demo Website: # https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737 # Backend: https://www.perfexcrm.com/demo/admin/authentication # Login/Password (admin): admin@test.com/123123 [!] :: Special Note: # Author of this web-application was warned about bad security measures. Nothing has changed. [!] :: For developers: # Disabling any data changes on a demo websites doesn't make your applications more secure. It's good for business and sales but you are simply double-crossing your clients. [+] :: PoC [Links]: # https://www.perfexcrm.com/demo/admin # https://www.perfexcrm.com/demo/admin/authentication # https://www.perfexcrm.com/demo/authentication/login # https://www.perfexcrm.com/demo/knowledge-base [+] :: PoC [Stored XSS Injection]: # Authorize on the demo website for tests, then go to https://www.perfexcrm.com/demo/admin/settings page. On the «Company Name» input field use payload like " onload="alert('QUIXSS');"/>, save the data and then you'll see that XSS filter is not triggered and your payload is successfully injected. # Sample payload #1: " onload="alert('QUIXSS');"/> # Sample payload #2: " onload="alert('QUIXSS');window.open('https://cxsecurity.com/');"/>

References:

https://codecanyon.net/item/perfex-powerful-open-source-crm/14013737


Vote for this issue:
80%
20%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top