Secur0 Cna

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report client logo field, which the server-side headless browser fetches while rendering the report.

**Name of the Vulnerable Software and Affected Versions** Prospero Flow CRM (affected versions not specified) **Description** An Insecure Direct Object Reference (IDOR) exists in the `DeleteNotificationController::delete()` method at the `GET /notification/delete/{id}` endpoint. This flaw allows any authenticated user to delete notifications belonging to any other user in the system, regardless of their company or permissions. The issue occurs because the controller uses `Notification::findOrFail($id)` to retrieve records without validating the `user id` or `company id` ownership. Since notification identifiers are sequential, an attacker can iterate through IDs to systematically delete notifications, preventing users from seeing ticket alerts, task assignments, and other system events. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `GET /notification/delete/{id}` endpoint to prevent unauthorized deletion of notifications.

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 1.1.0 **Description** Stored Cross-site Scripting occurs in the client-side report rendering functions `renderPreview()`, `renderEditor()`, and `renderAuditData()` located in js/app.js. A remote, authenticated attacker can execute arbitrary JavaScript in the browser of any user viewing an affected report. This is possible because payloads stored in a finding's `images` array or a report's `client logo` array are interpolated into an <img> src attribute without proper escaping. **Recommendations** Update maalfer Pentestify to version 1.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.5.3 **Description** An authorization bypass exists in the Order and OrderItem REST API controllers. A remote, authenticated user can read, modify, and delete orders and order items belonging to other companies (tenants) by providing a sequential numeric `id` to the following endpoints: - 'GET /api/order/{id}' - 'PUT /api/order/{id}' - 'GET /api/order-item/{id}' - 'PUT /api/order-item/{id}' - 'DELETE /api/order-item/{id}' This occurs because the controllers use the `Order::find($id)` and `Item::find($id)` functions to resolve records without restricting the search to the authenticated user's company. **Recommendations** Update to version 5.5.3.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.14.0 **Description** An authorization bypass exists in the Excel import handlers (CustomerImport, LeadImport, and ProductImport). A remote, authenticated user can create customer, lead, and product records within another company's tenant by uploading a spreadsheet to the POST '/customer/import/excel/save' endpoint. The system maps the `company id` variable directly from the uploaded file without verifying if it matches the authenticated user's company, allowing the `company id` to be controlled by the user. **Recommendations** Update Roskus Prospero Flow CRM to version 5.14.0 or later.

**Name of the Vulnerable Software and Affected Versions** Prospero Flow CRM versions prior to 5.5.3 **Description** An authorization flaw exists in the `BankAccountListController` (app/Http/Controllers/Api/BankAccount/BankAccountListController.php) at the GET '/api/bank-account' endpoint. A remote, authenticated attacker with a low-privileged role, such as User, can read arbitrary bank account records belonging to their company. This occurs because the API route is protected only by the `auth:api` middleware and lacks a permission gate, unlike the web route which enforces the `can('read bank')` check. The handler uses `Account::where('company id', Auth::user()->company id)->get()`, which only applies company scoping without verifying the user's role or permissions. This leads to the unauthorized disclosure of sensitive banking data, including IBAN, SWIFT/BIC, and account identifiers. **Recommendations** Update Prospero Flow CRM to version 5.5.3 or later. As a temporary mitigation, restrict access to the '/api/bank-account' endpoint to only authorized administrative roles.

**Name of the Vulnerable Software and Affected Versions** Prospero Flow CRM versions prior to 5.5.3 **Description** An authorization bypass exists in the `CalendarDeleteEventController` (app/Http/Controllers/Calendar/CalendarDeleteEventController.php) via the GET '/calendar/event/delete/{id}' endpoint. A remote, authenticated attacker can delete arbitrary calendar events belonging to other users by manipulating the `{id}` path parameter. This occurs because the delete handler uses the `Calendar::find($id)->delete()` function without performing ownership checks, such as scoping by `user id` or `company id`, leading to unauthorized destruction of data across the platform. **Recommendations** Update Prospero Flow CRM to version 5.5.3 or later. As a temporary mitigation, restrict access to the '/calendar/event/delete/{id}' endpoint.

**Name of the Vulnerable Software and Affected Versions** Pentestify versions 1.0.0 and earlier **Description** A Server-Side Request Forgery (SSRF) exists in the PDF generation endpoint "GET /api/reports/{id}/pdf" (backend/main.py). This occurs because the target URL is constructed using `request.base url` without proper validation. A remote attacker can use a crafted Host header to force the server to make requests to arbitrary internal or external URLs, including cloud metadata services, and receive the rendered content within the generated PDF. **Recommendations** Update Pentestify to a version later than 1.0.0. As a temporary mitigation, restrict access to the "GET /api/reports/{id}/pdf" endpoint.

**Name of the Vulnerable Software and Affected Versions** MailerUp versions prior to 1.0.1 **Description** Missing authentication for a critical function in the `RegisterView` (apps/accounts/views.py) allows a remote, unauthenticated attacker to self-register an account on instances where registration should be restricted. This occurs because the POST '/api/auth/register/' endpoint uses the `AllowAny` permission without requiring email verification, CAPTCHA, or administrator approval. An account created through this method can read all email stored by the instance, leading to full disclosure of stored messages. **Recommendations** Update to version 1.0.1 or later. Restrict access to the POST '/api/auth/register/' endpoint to prevent unauthorized self-registration.

**Name of the Vulnerable Software and Affected Versions** Mailerup versions prior to 1.0.0 **Description** An open redirect issue exists in the ` safe redirect()` function of the click-tracking endpoint '/c/<token>/'. Remote unauthenticated attackers can redirect users to arbitrary external sites to perform phishing attacks by manipulating the `u` query parameter. This occurs because the destination host is not restricted to an allowlist, and a `signing.BadSignature` exception is silently caught, removing the requirement for a valid signed token. While the URL scheme is validated to block `javascript:` and `data:` schemes, the lack of host validation allows the redirect. **Recommendations** Update to version 1.0.0 or later. As a temporary mitigation, restrict access to the '/c/<token>/' endpoint or avoid using the `u` query parameter until the update is applied.