Webkul krayin crm Edit Person Page 2 cross site scripting
CVE-2023-2925

5.4MEDIUM

Key Information:

Vendor
Webkul
Status
krayin crm
Vendor
CVE Published:
27 May 2023

Summary

A vulnerability, which was classified as problematic, was found in Webkul krayin crm 1.2.4. This affects an unknown part of the file /admin/contacts/organizations/edit/2 of the component Edit Person Page. The manipulation of the argument Organization leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230079. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Version(s)

krayin crm 1.2.4

References

https://vuldb.com/?id.230079
vdb-entrytechnical-description
https://vuldb.com/?ctiid.230079
signaturepermissions-required
https://drive.google.com/file/d/1t7JwP0Qyo6ye-2dt6XhA1ENH...
exploit

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

huutuanbg97 (VulDB User)
.