YetiForce CRM < 3.1 - Persistent XSS

ID EDB-ID:39998
Type exploitdb
Reporter David Silveiro
Modified 2016-06-21T00:00:00


YetiForce CRM < 3.1 - Persistent XSS. Webapps exploit for php platform

                                            # Exploit Title: YetiForce CRM &lt; 3.1  - Persistant XSS Vulnerability
# Exploit Author: David Silveiro 
# Exploit Author Github:
# Exploit Author Twitter: 
# Vendor Homepage:
# Software Link:
# Date: Fixed on 20th June 2016

YetiForce CRM was built on a rock-solid Vtiger foundation, but has hundreds of changes that help to accomplish even the most challenging tasks in the simplest way

YetiForce is vulnerable to a stored XSS vulnerability present within a users comment section.


Within 'Companies & Accounts &gt; Accounts' select your prefered user, and then in the 'Comments' section input;

&lt;img src=x onerror=alert('XSS');&gt;

Either refresh the current page, or navigate back to 'Accounts'