CyberRota Analysis
AI-GeneratedThe Ekushey Project Manager CRM is vulnerable due to improper output encoding of the administrator-configured system name, which is displayed on the login page. This flaw allows an attacker with administrator access to inject malicious HTML or JavaScript, leading to cross-site scripting (XSS) that executes in the browsers of all visitors, including unauthenticated users. Organizations using this CRM should prioritize addressing this vulnerability to protect against potential exploitation and unauthorized script execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.