Stored XSS Vulnerability in Webkul Krayin CRM 1.3.0
CVE-2024-46367

9.6CRITICAL

Key Information:

Vendor

Webkul

Status
Krayin Crm
Vendor
CVE Published:
27 September 2024

What is CVE-2024-46367?

A vulnerability exists in Webkul Krayin CRM 1.3.0, allowing remote attackers to execute arbitrary JavaScript code by injecting malicious payloads into the username field. If exploited, this Stored Cross-Site Scripting (XSS) vulnerability can lead to unauthorized privilege escalation, enabling attackers to gain elevated permissions and compromise the integrity of the CRM system.

References

https://gist.github.com/Tommywarren/4ac0c8f6e5d8584accd31...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.