{“lastseen”:”2025-12-08T15:28:24″,”description”:”Coohoom SaaS is susceptible to a persistent cross site scripting vulnerability…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Coohom SaaS Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212532″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65300″],”sourceData”:”# CVE-2025-65300\\n \\n [Description]\\n \\n CVE-2025-65300: Stored Cross-Site Scripting (XSS) Vulnerability in Coohom SaaS Platform\\n \\n Disclosure Date: 2025-10-28\\n Last Updated: 2025-10-28\\n Reporter: Phisit Pupiw\\n Vendor: Coohom\\n CWE: CWE-79 \u2013 Cross-Site Scripting\\n \\n ——————————————\\n \\n [Summary]\\n \\n A stored Cross-Site Scripting (XSS) vulnerability was identified in the Coohom SaaS Platform within the Account Settings \u2192 Profile \u2192 Address module. User-supplied input stored in the City, State, and Country\/Region fields is rendered back to the client without proper sanitization or context-aware output encoding.\\n This allows attackers to store malicious JavaScript payloads that execute whenever the affected profile area is viewed.\\n The issue affects production build feVersion=1760060603897 (verified on 2025-10-28).\\n \\n ——————————————\\n \\n [Vulnerability Details]\\n \\n The frontend renders user data directly from \\”window.SAAS_ENV.userInfo.{city, state, country}\\” without sanitization or escaping, causing stored XSS when injected payloads are stored in the database and later displayed in the UI.\\n Example Malicious Payload \\”\\u003c\/script\\u003e\\u003cscript\\u003ealert(document.cookie)\\u003c\/script\\u003e\\” When this payload is entered into the City field, saved, and the profile page is reloaded, arbitrary JavaScript executes in the victim\u2019s browser.\\n \\n ——————————————\\n \\n [Affected Components]\\n \\n Module: Account Settings \u2192 Profile \u2192 Address fields\\n Fields: city, state, country\\n Frontend Build Affected: feVersion=1760060603897\\n Production URL: https:\/\/www.coohom.com\/pub\/saas\/settings\/account\\n \\n ——————————————\\n \\n [Impact]\\n \\n An attacker can perform the following:\\n – Execute arbitrary JavaScript in the victim\u2019s browser\\n – Steal session cookies (subject to browser protections)\\n – Perform actions on behalf of the victim\\n – Redirect users or inject malicious content\\n – Persist malicious scripts affecting all future views\\n \\n ——————————————\\n \\n [Attack Vector]\\n \\n – Access Required: Authenticated user\\n – Attack Type: Remote\\n – User Interaction: Viewing affected profile page\\n \\n ——————————————\\n \\n [Attack Flow]\\n \\n 1. Attacker signs in or registers a Coohom account\\n 2. Navigates to Account Settings \u2192 Profile \u2192 Address\\n 3. Inserts malicious payload into City, State, or Country\/Region\\n 4. Saves the form\\n 5. Script executes whenever the profile section is rendered\\n \\n ——————————————\\n \\n [Proof of Concept (PoC)]\\n \\n Steps to Reproduce\\n 1. Login to Coohom (https:\/\/www.coohom.com)\\n 2. Open Account Settings \u2192 Profile \u2192 Address\\n 3. Input the payload below into the City field \\”\\u003c\/script\\u003e\\u003cscript\\u003ealert(document.cookie)\\u003c\/script\\u003e\\”\\n 4. Save and refresh the page\\n 5. JavaScript executes immediately \u2192 confirming stored \\n \\n ——————————————\\n \\n [Recommendation]\\n \\n – Sanitize input on save\\n – Reject HTML tags and dangerous attributes\\n – HTML-encode\\n – JavaScript-encode\\n – Attribute-encode\\n – Implement Content-Security-Policy (CSP)\\n – Disable inline scripts with script-src ‘self’\\n \\n ——————————————\\n \\n [References]\\n \\n – https:\/\/www.coohom.com\/pub\/saas\/settings\/account\\n – CVE record status (MITRE): CVE-2025-65300 (RESERVED)\\n \\n ——————————————\\n \\n [Credits]\\n \\n Discovered by : Phisit Pupiw”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212532″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212532\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-08T15:28:24″,”description”:”Coohoom SaaS is susceptible to a persistent cross site scripting vulnerability…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Coohom SaaS Cross Site Scripting”,”source”:””,”references”:””,”id”:”PACKETSTORM:212532″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-65300″],”sourceData”:”# CVE-2025-65300\\n \\n [Description]\\n \\n CVE-2025-65300: Stored Cross-Site Scripting (XSS)…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-29321","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n