CVE-2024-45932: Krayin CRM Vulnerable to XSS via Organization Name Field
Summary
CVE-2024-45932: Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name. Affects krayin/laravel-crm versions < 1.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Krayin CRM is an open-source customer relationship management system built on Laravel. It provides features for managing contacts, organizations, and sales processes. The system is designed to help businesses streamline their customer interactions and improve their sales workflows. However, version 1.3.0 of Krayin CRM has been identified to have a vulnerability that allows for Cross Site Scripting (XSS) attacks through the organization name field, which can compromise user data and application integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the organization name field located at '/admin/contacts/organizations/edit/2'. An attacker can exploit this flaw by injecting malicious scripts into the organization name, which, when rendered in the browser, can execute arbitrary JavaScript code. This can lead to session hijacking, data theft, or unauthorized actions performed on behalf of the user. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), and it poses a moderate risk with a CVSS score of 4.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs on the organization name field to prevent script injection. Implement input validation and encoding to ensure that any HTML or JavaScript code is not executed. For example, you can use PHP's htmlspecialchars function:
$sanitized_name = htmlspecialchars($organization_name, ENT_QUOTES, 'UTF-8');
Conclusion
The identified vulnerability in Krayin CRM (CVE-2024-45932) poses a moderate risk due to its potential for Cross Site Scripting attacks via the organization name field. It is crucial for users to update their packages to the latest version to ensure security. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for krayin/laravel-crm →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Exploiting this vulnerability can lead to session hijacking, data theft, and unauthorized actions performed on behalf of users, which can severely compromise application security.
Yes, a patch is available. Update your Krayin CRM package to a version higher than 1.3.0 to mitigate this vulnerability.
If you cannot update the package right away, implement input validation and sanitization as a temporary workaround to mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for krayin/laravel-crm.
