YetiForce CRM < 3.1 - Persistent Cross-Site Scripting

• Exploit Database
• 17 阅读

• 作者： David Silveiro
  日期： 2016-06-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/39998/

• # Exploit Title: YetiForce CRM < 3.1- Persistant XSS Vulnerability
  # Exploit Author: David Silveiro 
  # Exploit Author Github: github.com/davidsilveiro
  # Exploit Author Twitter: twitter.com/david_silveiro 
  # Vendor Homepage: https://yetiforce.com/
  # Software Link: http://sourceforge.net/projects/yetiforce/
  # Date: Fixed on 20th June 2016
  
  YetiForce CRM was built on a rock-solid Vtiger foundation, but has hundreds of changes that help to accomplish even the most challenging tasks in the simplest way
  
  YetiForce is vulnerable to a stored XSS vulnerability present within a users comment section.
  
  POC:
  
  Within 'Companies & Accounts > Accounts' select your prefered user, and then in the 'Comments' section input;
  
  <img src=x onerror=alert('XSS');>
  
  Either refresh the current page, or navigate back to 'Accounts'