medium5.4Public exploit code
CVE-2022-48177
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)2023-04-08 · webapps · php
Impact
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| X2engine | X2crm | Versions 6.6, 6.9 |