medium5.4Public exploit code
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to th…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ekushey Project Manager CRM 3.1 - Cross-Site Scripting2018-10-25 · webapps · php
Impact
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Creativeitem | Ekushey Project Manager | Version 3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/45681/
- http://packetstormsecurity.com/files/149842/Ekushey-Project-Manager-CRM-3.1-Cross-Site-Scripting.html
- https://www.exploit-db.com/exploits/45681/