PT-2023-29546 · Small Crm · Small Crm

Kartik · Publicado 2023-10-19 · Atualizado 2023-10-30 · CVE-2023-45394

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Small CRM version 3.0

Description The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability in the Company field of the "Request a Quote" section. This allows an attacker to store and execute malicious javascript code in the Admin panel, potentially leading to Admin account takeover.

Recommendations For Small CRM version 3.0, consider disabling the "Request a Quote" section or restricting access to the Company field until a patch is available to prevent the execution of malicious javascript code. Additionally, monitor Admin panel activity closely for signs of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-45394

Produtos afetados

Small Crm

Referências · 6

• 🔥 https://github.com/kartik753/CVE/blob/main/CVE-2023-45394 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45394 · Nota de Segurança
• https://t.me/cvenotify/60193 · Publicação no Telegram
• https://t.me/cibsecurity/72641 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-45394 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1715220961618776272 · Publicação no Twitter