CVE-2014-10009

Stark CRM 1.0 is affected by multiple stored XSS vulnerabilities due to unsanitized input in several POST parameters: first_name, last_name, notes (client page); insu_name, price (add_insurance_cat); and status[] (add_status). The root cause is improper input validation/exploitation of input pars...

CVE-2014-10008

CVE-2014-10008 (Stark CRM v1.0) is documented in connected sources as CSRF vulnerabilities that enable forged requests to admin pages (admin/agent/sub_agent/partner/client) to hijack administrator authentication and perform privileged actions. ZSL-2014-5169 additionally notes stored XSS and sessi...