X2CRM v8.5: When Opportunities Knock with XSS!
X2CRM v8.5 has a stored XSS vulnerability that’s like a surprise party for hackers. Just log in, sprinkle some malicious code into the “Opportunities” section, and watch the chaos unfold the next time someone clicks on “Lists.” Hackers, rejoice! Security teams, not so much.
Hot Take:
Who knew that playing around with the “Opportunities” section could lead to such an “opportunistic” XSS vulnerability? Looks like X2CRM v8.5 took the phrase “stored value” a little too literally, storing scripts that could make a hacker’s day as bright as a flashing alert box!
Key Points:
- X2CRM v8.5 is vulnerable to stored Cross-Site Scripting (XSS).
- The vulnerability can be exploited by authenticated users.
- The exploit involves entering a malicious script in the “Name” field while creating a list.
- The vulnerability is triggered when revisiting the “Lists” section.
- Tested on Ubuntu 22.04 and documented under CVE-2024-48120.
Already a member? Log in here