PT-2023-29546 · Small Crm · Small Crm

Kartik · Published 2023-10-19 · Updated 2023-10-30 · CVE-2023-45394

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Small CRM version 3.0

Description The issue is related to a Stored Cross-Site Scripting (XSS) vulnerability in the Company field of the "Request a Quote" section. This allows an attacker to store and execute malicious javascript code in the Admin panel, potentially leading to Admin account takeover.

Recommendations For Small CRM version 3.0, consider disabling the "Request a Quote" section or restricting access to the Company field until a patch is available to prevent the execution of malicious javascript code. Additionally, monitor Admin panel activity closely for signs of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-45394

Affected Products

Small Crm

References · 6

• 🔥 https://github.com/kartik753/CVE/blob/main/CVE-2023-45394 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-45394 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45394 · Vendor Advisory
• https://t.me/cvenotify/60193 · Telegram Post
• https://t.me/cibsecurity/72641 · Telegram Post
• https://twitter.com/CVEnew/status/1715220961618776272 · Twitter Post