CVE-2025-10341
BaseFortify
Publication date: 2025-09-29
Last updated on: 2025-10-02
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| perfexcrm | perfex_crm | From 3.2.1 (inc) to 3.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a stored HTML injection in Perfex CRM version 3.2.1. It occurs because the application does not properly validate user input sent via a POST request in the 'company' parameter at the '/clients/client/x' endpoint. This allows an attacker to inject malicious HTML code that is stored and later executed in the context of the application.
How can this vulnerability impact me? :
The impact of this vulnerability includes the potential for attackers to execute malicious HTML code within the application, which can lead to unauthorized actions such as content manipulation, phishing, or session hijacking. Since it is a stored injection, the malicious code can affect multiple users who access the infected data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending crafted POST requests to the endpoint '/clients/client/x' with malicious HTML content in the 'company' parameter and observing if the input is stored and rendered without proper sanitization. A simple detection command using curl could be: curl -X POST -d "company=<script>alert('XSS')</script>" https://your-perfex-crm-domain/clients/client/x If the script executes when viewing the stored data, the vulnerability is present.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Perfex CRM to the latest version where the vulnerability has been fixed by the development team. Additionally, applying input validation and sanitization on the 'company' parameter at the server side can help prevent stored HTML injection. Restricting user input to safe characters and employing web application firewalls to detect and block malicious payloads are also recommended.