Description

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-04T04:18:08.410Z",
  "pubdate": "2026-09-04T04:18:08.410Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the Eleveo Call Recording Software version 9.7.0. The vulnerability is located within the /callrec/roleAddAction.do endpoint, specifically triggered via the manipulation of the 'name' or 'username' arguments.\nThis vulnerability allows a remote, unauthenticated or authenticated attacker to inject malicious client-side scripts into the web application, which are subsequently executed within the context of a victim's browser session.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, and the exfiltration of sensitive information processed by the Call Recording platform.\nGiven that public exploit code is available and the vendor has not provided a response or official patch, the risk profile is considered high. Organizations deploying Eleveo 9.7.0 are exposed to potential remote exploitation.\nImmediate defensive measures are required to restrict access to the affected endpoint or implement input sanitization controls as there is currently no vendor-supplied remediation.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw identified in the Eleveo Call Recording Software 9.7.0. The root cause lies in the improper neutralization of user-supplied input handled by the /callrec/roleAddAction.do Java-based action handler.\nSpecifically, the application fails to perform adequate output encoding or context-aware validation on the 'name' and 'username' parameters before reflecting them back to the user interface during the processing of role creation or modification requests.\nThe attack flow begins when an attacker crafts a malicious URL or payload containing JavaScript embedded within the 'name' or 'username' parameter. When a targeted user—often an administrator—accesses the manipulated request or is coerced into visiting a crafted link, the malicious script is returned as part of the HTML response.\nBecause the server does not enforce Content Security Policy (CSP) or sanitize the inputs, the victim's browser interprets the injected payload as trusted, executable code. This occurs in the context of the origin where the Eleveo application is hosted, allowing the script to access cookies, session tokens, or Document Object Model (DOM) elements associated with the session.\nThe exploitation process does not require deep internal access to the server, as it relies on the victim's interaction with the manipulated parameter. Once the payload executes, an attacker can steal session cookies, perform unauthorized administrative actions (such as adding new malicious users or modifying system roles), or redirect users to malicious domains for further credential harvesting.\nThe lack of input validation at the controller level for /callrec/roleAddAction.do facilitates this injection. Since the vulnerability is remotely exploitable, attackers can target the application over any network path that reaches the web interface, making this a high-risk entry point for platform compromise.\nGiven that exploit primitives are currently public, the barrier to entry for attackers is significantly low, requiring minimal technical sophistication to weaponize the flaw against vulnerable instances."
}