Vulnerability · Published Jun 2, 2023 · Assigned by VulDB
CVE-2023-305807FLY CRM User Profile cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in CRM from 07FLY. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.6%top 53.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in 07FLY CRM up to 1.2.0. It has been declared as problematic. This vulnerability affects unknown code of the component User Profile Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230560.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.230560 vdb-entry
- https://vuldb.com/?ctiid.230560 signature, permissions-required
- https://gitee.com/07fly/FLY-CRM/issues/I76K4N exploit, issue-tracking