CyberRota Analysis
AI-GeneratedThe Create Customer Endpoint in the feelec-yishu feelcrm-os 1.0.0 application is vulnerable to cross-site scripting (XSS) due to improper handling of the customer_form[remark] argument in the htmlspecialchars_decode function. This vulnerability allows remote attackers to execute malicious scripts in the context of the user's session. Organizations using this software should prioritize patching this issue to mitigate potential exploitation, especially if they handle sensitive customer data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.