Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

Valid

Reported on

Dec 14th 2021


Description

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

Proof of Concept

1. Go to Virtual desk > Calendar

2. Add a Meeting/Call/To Do, put a XSS payload into Meeting URL field. E.g: https://www.google.com/#"><img/src/onerror=alert('xss')>

3. Save then back to Calendar, click on the event just add above, click to the Meeting URL and XSS script will executed

Impact

XSS can have huge implications for a web application and its users. User accounts can be hijacked, change the html screen and insult the organization. Credentials could be stolen, sensitive data could be exfiltrated, and lastly, access to your client computers can be obtained.

We are processing your report and will contact the yetiforcecompany/yetiforcecrm team within 24 hours. a year ago
Radosław Skrzypczak validated this vulnerability a year ago
laladee has been awarded the disclosure bounty
The fix bounty is now up for grabs
Radosław Skrzypczak marked this as fixed in 6.4.0 with commit 6b5967 a year ago
Radosław Skrzypczak has been awarded the fix bounty
This vulnerability will not receive a CVE
MeetingModal.tpl#L15 has been validated
MeetingModal.tpl#L24 has been validated
MeetingModal.tpl#L106 has been validated
MeetingModal.tpl#L98 has been validated
Mariusz
a year ago

Maintainer


Bug fixed in 6.3.0_SecurityFix https://github.com/YetiForceCompany/UpdatePackages/tree/master/YetiForce%20CRM%206.x.x/6.3.0_SecurityFix/zip

Mariusz
a year ago

Maintainer


Bug fixed in 6.3.0_SecurityFix https://github.com/YetiForceCompany/UpdatePackages/tree/master/YetiForce%20CRM%206.x.x/6.3.0_SecurityFix/zip

to join this conversation