Exploit for CVE-2025-60374

## https://sploitus.com/exploit?id=3EE00381-0B6D-5FF7-A399-83D65E70D9A1
# CVE-2025-60374
CVE-2025-60374: Stored Cross-Site Scripting (XSS) in Perfex CRM Chatbot

> **⚠️ Security Advisory**  
> A critical Stored Cross-Site Scripting vulnerability in Perfex CRM's chatbot feature

[![CVE](https://img.shields.io/badge/CVE-2025--60374-red)](https://vulners.com/cve/CVE-2025-60374)
[![Severity](https://img.shields.io/badge/Severity-High-orange)]()
[![CWE](https://img.shields.io/badge/CWE-79-blue)](https://cwe.mitre.org/data/definitions/79.html)

---

## 📋 Overview

A Stored Cross-Site Scripting (XSS) vulnerability has been discovered in Perfex CRM's chatbot feature. This vulnerability allows attackers to inject malicious HTML and JavaScript code that gets stored on the server and executed in victims' browsers when they view chat messages.

## 🎯 Affected Versions

- **Product:** Perfex CRM
- **Vendor:** Perfex CRM
- **Vulnerable Versions:** 
```

### PoC 2: Interactive Button XSS
```html
Click here
```

### PoC 3: Auto-playing Embedded Content
```html


```

### PoC 4: Event-based XSS
```html

2 out of 10

```

### Real-World Attack Scenario

**Cookie Theft Example:**
```javascript

```

This payload would send the victim's session cookie to an attacker-controlled server, enabling complete account takeover.

## 🛡️ Mitigation

### For End Users

1. **✅ Upgrade Immediately:** Update to Perfex CRM v3.3.1 or later
2. **🔍 Audit Messages:** Review chatbot history for suspicious HTML/JavaScript content
3. **🔄 Reset Sessions:** Force all users to re-authenticate after patching
4. **📝 Monitor Logs:** Check for unusual chatbot activity

### For Developers

#### Immediate Fixes
```php
// Input Sanitization Example
$message = htmlspecialchars($input_message, ENT_QUOTES, 'UTF-8');

// Output Encoding Example
echo htmlspecialchars($stored_message, ENT_QUOTES, 'UTF-8');
```

#### Long-term Security Improvements

1. **Content Security Policy (CSP)**
```http
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
```

2. **HttpOnly Cookies**
```php
setcookie('session', $value, [
    'httponly' => true,
    'secure' => true,
    'samesite' => 'Strict'
]);
```

3. **Input Validation Library**
```php
// Use DOMPurify, HTML Purifier, or similar
$clean_html = $purifier->purify($dirty_html);
```

## 📚 References

- [CWE-79: Cross-site Scripting (XSS)](https://cwe.mitre.org/data/definitions/79.html)
- [OWASP XSS Prevention Cheat Sheet](https://owasp.org/www-community/attacks/xss/)
- [CVE-2025-60374 Official Entry](https://vulners.com/cve/CVE-2025-60374)


## 👤 Credits

**Discovered by:** Ajansha Shankar

## 📧 Contact

For questions or additional information:
- **LinkedIn:** https://www.linkedin.com/in/ajansha-shankar/