CVE-2025-40643
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-10-31

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/create_job_submit.php”, using the “JobCreatedBy” parameter. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-23
Last Modified
2025-10-31
Generated
2026-06-16
AI Q&A
2025-10-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-40643
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
energycrm energy_crm 2025
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-40643 is a Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd. It occurs because the application does not properly validate user input sent via the 'JobCreatedBy' parameter in a POST request to '/crm/create_job_submit.php'. This allows a remote attacker to craft a malicious query that, when viewed by an authenticated user, executes malicious scripts stored in the system, potentially stealing the user's session cookies. [1]

Impact Analysis

This vulnerability can impact you by allowing an attacker to execute malicious scripts in the context of an authenticated user's session. Specifically, it can lead to theft of session cookies, which may allow the attacker to hijack the user's session and gain unauthorized access to the CRM system, potentially compromising sensitive data and user accounts. [1]

Detection Guidance

This vulnerability can be detected by sending a crafted POST request to the endpoint "/crm/create_job_submit.php" with a malicious payload in the "JobCreatedBy" parameter and observing if the input is improperly validated and stored, leading to execution of the script when viewed by an authenticated user. For example, using curl to test the vulnerability: curl -X POST -d "JobCreatedBy=<script>alert(1)</script>" https://target-domain/crm/create_job_submit.php and then checking if the script executes when the relevant page is accessed by an authenticated user. [1]

Mitigation Strategies

Since no solution or patch has been reported at this time, immediate mitigation steps include restricting access to the affected endpoint to trusted users only, implementing input validation and sanitization on the server side if possible, and educating users to avoid clicking on suspicious links or queries. Additionally, monitoring for unusual activity and considering temporary disabling of the vulnerable functionality until a patch is available can help reduce risk. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-40643. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart