XSS Stored in Zurmo CRM

vendor:

Zurmo CRM

by:

Provensec

8,8

CVSS

HIGH

XSS Stored

CWE

Product Name: Zurmo CRM

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: a:zurmo:zurmo_crm

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2018

ZumoCRM is prone to a Persistent Cross Site Scripting attack that allows a malicious user to inject HTML or scripts that can access any cookies, session tokens, or other sensitive information retained by your browser and used with that site. Proof of concept includes creating a report as a Normal user, selecting module Accounts, selecting filter Name, selecting column Employees and as a value use: '><script>alert('XSS by Provensec')</script> and saving the report and sharing it with other users to distribute the malicious code.

Mitigation:

To mitigate this vulnerability, users should ensure that all input is properly sanitized and validated before being used in the application. Additionally, users should ensure that all output is properly encoded before being sent to the browser.

Source

Exploit-DB raw data:

# Affected software: Zurmo CRM
# Zurmo is an Open Source Customer Relationship Management (CRM)
application that is
# mobile, social, and gamified. We use a test-driven methodology for
building every part of the # application.
# Type of vulnerability: XSS Stored
# URL: zurmo.com
#
# Discovered by: Provensec
# Website: http://www.provensec.com

# Description: ZumoCRM is prone to a Persistent Cross Site Scripting attack
that allows a malicious user to inject HTML or scripts that can access any
cookies, session tokens, or other
sensitive information retained by your browser and used with that site.
# Proof of concept
# 1. Create a report as a Normal user
# 2. Select module: Accounts
# 3. Select filter: Name
# 4. Select column Employees and as a value use: "><script>alert('XSS by
Provensec')</script>
# 5. Save the report and share it with other users to distribute your
malicious code.