Stored Cross-Site Scripting in CrushFTP by Crush FTP, Inc.

CVE-2021-44076

Summary

A vulnerability was identified in CrushFTP 9 that permits an attacker with administrative access to exploit the /WebInterface/UserManager/ system. This exploitation occurs by creating a new user, thereby enabling Stored Cross-Site Scripting (XSS). The injected malicious payload can manifest in various ways, including executing when the user's profile is viewed in the Most Visited section. This flaw poses a risk as it can lead to unauthorized actions and data breaches, making it crucial for administrators to secure their environments promptly.

References