Description

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customer_form[remark] results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-10-05T11:16:46.617Z",
  "pubdate": "2026-10-05T11:16:46.617Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the feelec-yishu feelcrm-os 1.0.0 software. The vulnerability resides within the Create Customer Endpoint, specifically affecting the handling of the 'customer_form[remark]' argument.\nThe flaw occurs because the application fails to adequately sanitize user-supplied input before rendering it in the browser, allowing for the injection and execution of arbitrary JavaScript.\nThis vulnerability is classified as an XSS issue, which can lead to unauthorized actions performed on behalf of legitimate users, potential session hijacking, and the theft of sensitive session tokens or cookies.\nThe vulnerability can be exploited remotely by an unauthenticated or authenticated attacker, depending on the exposure of the endpoint. As an exploit has been made public and the vendor has not responded to vulnerability disclosure, the risk to deployments of feelcrm-os 1.0.0 is significant.",
  "technicalDetails": "The vulnerability is located in the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php within the Create Customer Endpoint component of feelcrm-os version 1.0.0.\nThe root cause is improper input validation and output encoding within the 'htmlspecialchars_decode' function processing logic. While the application attempts to decode HTML entities, it fails to perform adequate context-aware sanitization of the 'customer_form[remark]' input parameter before the data is processed or subsequently reflected to the user interface.\nThe attack flow begins when an attacker crafts a malicious payload containing JavaScript, such as '<script>alert(document.cookie)</script>', and submits it through the 'customer_form[remark]' field during the customer creation process.\nThe server processes this input, and due to the flaw in the CrmDefineFormModel.class.php logic, the malicious payload is stored in the database without being properly neutralized. When the application later retrieves this record and reflects it in the administrative dashboard or customer management interface, the browser interprets the payload as legitimate script code.\nBecause the payload is persisted on the server, this is a Stored XSS vulnerability. Any user, including administrators with higher privileges, who views the compromised customer record will execute the injected script within the context of their own session.\nThe execution of the script occurs within the victim's browser, granting the attacker the ability to bypass the same-origin policy, intercept sensitive cookies or session tokens, modify the Document Object Model (DOM) of the page, or perform unauthorized actions as the victim user.\nThe exploitation is trivial as it only requires the attacker to submit a standard HTTP POST request containing the malicious payload to the affected endpoint. As the vulnerability is remote and the exploit code is publicly available, the barrier to entry for potential attackers is extremely low."
}