ajansha/cve-2025-60374CVE-2025-60374: Stored Cross-Site Scripting (XSS) in Perfex CRM Chatbot
CVE-2025-60374: Stored Cross-Site Scripting (XSS) in Perfex CRM Chatbot
⚠️ Security Advisory
A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature
A stored cross-site scripting (XSS) vulnerability in the chatbot component of Perfex CRM, prior to version 3.3.1, allows attackers to inject arbitrary JavaScript code through chat messages. The malicious payload is stored in the application database and executed in the browsers of users viewing the chat conversation, enabling session token theft, unauthorized actions on behalf of victims, and other client-side attacks.
| Attribute | Value |
|---|---|
| CVE ID | CVE-2025-60374 |
| Type | Stored Cross-Site Scripting (XSS) |
| CWE | CWE-79 |
| Attack Vector | Network/Remote |
| Authentication | Required (Low Privilege) |
| User Interaction | None to Minimal |
| Discoverer | Ajansha Shankar |
The chatbot's message parameter in Perfex CRM lacks proper input sanitization and output encoding. When users submit messages through the chatbot interface, malicious HTML/JavaScript payloads are stored in the database without adequate filtering and subsequently rendered without proper escaping, leading to code execution in other users' browsers.
HttpOnlydocument.cookie access| Factor | Impact | Explanation |
|---|---|---|
| Confidentiality | 🔴 HIGH | Session tokens and sensitive data can be stolen |
| Integrity | 🔴 HIGH | Unauthorized actions can be performed as the victim |
| Availability | 🟡 LOW | Limited impact on system availability |
<button onclick=alert('Click executed!')>Click here</button>
<meter value=2 min=0 max=10 onmouseover=alert('XSS triggered!')>
2 out of 10
</meter>
Cookie Theft Example:
This payload would send the victim's session cookie to an attacker-controlled server, enabling complete account takeover.
// Input Sanitization Example
$message = htmlspecialchars($input_message, ENT_QUOTES, 'UTF-8');
// Output Encoding Example
echo htmlspecialchars($stored_message, ENT_QUOTES, 'UTF-8');
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
setcookie('session', $value, [
'httponly' => true,
'secure' => true,
'samesite' => 'Strict'
]);
// Use DOMPurify, HTML Purifier, or similar
$clean_html = $purifier->purify($dirty_html);
Discovered by: Ajansha Shankar , Ahamed Yaseen