Description

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-25T18:17:52.370Z",
  "pubdate": "2026-08-25T18:17:52.370Z",
  "executiveSummary": "Ekushey Project Manager CRM is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability residing in the administrative system configuration settings.\nThe vulnerability occurs because the application fails to perform proper output encoding on the user-defined system name before rendering it on the login page.\nBy injecting malicious HTML or JavaScript into the system name field, an authenticated administrator can execute arbitrary code in the context of any visitor's browser session, including unauthenticated users visiting the login portal.\nThe risk is severe as the payload persists indefinitely until manually modified by an administrator. Because the execution occurs on the login page, it exposes unauthenticated users to potential credential harvesting, session hijacking, or malicious redirection.\nThis vulnerability requires an initial administrative session to inject the payload, but its impact extends to the entire user base of the application. The persistent nature of this flaw allows for long-term monitoring or exploitation of the system's front-end interface.",
  "technicalDetails": "The vulnerability is a classic Stored Cross-Site Scripting (XSS) flaw stemming from the application's failure to sanitize or encode user-supplied input stored in the system's configuration database.\nSpecifically, the system name setting, intended to identify the CRM installation, is written to the login page without output sanitization across three distinct locations: the 'description' meta element, the document 'title' element, and an 'h4' header element.\nThe 'h4' element serves as the primary vector for exploitation; because the browser interprets this tag's inner content as HTML markup, any JavaScript injected via event handlers (e.g., 'onload', 'onerror') or script tags is parsed and executed by the client's browser.\nThe attack flow proceeds as follows: First, an attacker with administrative privileges navigates to the configuration panel and injects a malicious payload into the system name field. Upon saving, the server stores this unsanitized string in the backend database. Subsequently, whenever any visitor—authenticated or unauthenticated—requests the login page, the server embeds the stored malicious string directly into the HTML response.\nWhen the victim's browser parses the document, it encounters the injected script within the 'h4' tag and executes it within the origin of the CRM login page. This environment is particularly sensitive as the script runs alongside the application's login form. Consequently, an attacker can programmatically capture user credentials as they are typed, modify the DOM to present a phishing interface, or redirect the user to an external malicious domain.\nBecause the payload is stored persistently in the database, it remains active for every session until an administrator updates or clears the configuration. The vulnerability is highly effective because it does not require interaction from the victim other than navigating to the login page, and it operates entirely within the trust boundary of the host application, potentially bypassing basic security controls that monitor for cross-domain threats."
}