PT-2022-15249 · Unknown · Daybyday Crm

Published 2022-01-13 · Updated 2022-01-20 · CVE-2022-22112

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DayByDay CRM versions 1.1 through 2.2.1

Description The issue is related to an application-wide Client-Side Template Injection (CSTI) that allows a low-privileged attacker to input template injection payloads in various locations within the application. This enables the execution of JavaScript on the client's browser.

Recommendations For DayByDay CRM versions 1.1 through 2.2.1, consider restricting user input in areas where template injection payloads can be executed until a patch is available. As a temporary workaround, limit the ability to input JavaScript code in the application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-22112

Affected Products

Daybyday Crm

References · 5

• 🔥 https://whitesourcesoftware.com/vulnerability-database/CVE-2022-22112 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-22112 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22112 · Vendor Advisory
• https://github.com/Bottelet/DaybydayCRM/blob/2.2.1/resources/views/partials/clientheader.blade.php#L17 · Note
• https://t.me/cvenotify/25376 · Telegram Post