ajansha

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of payload withheld, including vulnerability description, impact, proof-of-concept payload snippets, and mitigation guidance. It does not contain any standalone executable script, scanner, or automated exploitation tool. The PoC snippets are illustrative HTML/JavaScript fragments embedded in a markdown document, not functional exploit or scanner code.

Requirements

• Attacker must be authenticated with low privileges to submit a chat message.README.md:32
• A victim user must view the chat conversation containing the stored payload.README.md:15

Observed behavior

• The writeup describes injecting HTML/JavaScript payloads into chat messages that are stored and later executed in other users' browsers.README.md:15
• Example payloads include an image onerror handler, a button onclick handler, an iframe, a meter onmouseover handler, and a cookie-stealing fetch request.README.md:68-98

Observables

Vulnerability Documentation

Payload withheldThe file documents a stored XSS vulnerability in Perfex CRM chatbot, including PoC examples and mitigation advice.README.md:1-155

Classification basis

The artifact is a README.md file containing a technical advisory with a summary, impact, reproduction steps, and mitigation for payload withheld. It does not contain any executable code, scripts, or commands that constitute an exploit or scanner. It is a substantive technical analysis, classifying it as a writeup.

Requirements

• Ability to send HTTP requests to the admin login endpoint.README.md:20

Observed behavior

• The writeup describes a method to bypass authentication by sending empty username and password parameters to the login endpoint, resulting in unauthorized access to user accounts, including administrative accounts.README.md:13README.md:25-27

Observables

Vulnerability Documentation

Payload withheldThe file is a human-readable advisory describing an authentication bypass in Perfex CRM. It includes reproduction steps that involve manipulating HTTP requests, which is normal exploit documentation for this class of vulnerability.README.md:1-52

Classification basis

The artifact is a detailed technical writeup describing a vulnerability, its impact, and reproduction steps. It contains no executable code, scripts, or automated scanning logic. The 'Proof of Concept' section provides manual instructions and example HTML payloads but does not constitute an exploit or scanner.

Requirements

• Authenticated user with invoice/message creation permissions in RISE CRMREADME.md:100-101
• RISE CRM version prior to 3.9.4README.md:20-21

Observed behavior

• Describes injecting HTML payloads into invoice line items, client notes, and messaging modulesREADME.md:15
• Provides example HTML payloads for phishing, image tracking, and misleading linksREADME.md:81-126
• Outlines manual steps to reproduce the vulnerability and verify HTML rendering in emails, PDFs, and chatREADME.md:103-145

Observables

Documentation Only

Payload withheldThe entire artifact consists of a single Markdown file with no executable code, scripts, or binary payloads.README.md:1-213

Contact Information

Payload withheldAuthor contact information is present but does not constitute backdoor behavior.README.md:181

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of payload withheld, including vulnerability description, impact, and manual reproduction steps. It contains no executable code, scripts, or automated scanning logic; the 'PoC Steps' are purely descriptive instructions for a human operator. This constitutes a writeup.

Requirements

• Authenticated user with invoice creation permissions in PerfexCRMREADME.md:86-87

Observed behavior

• Describes injecting HTML payloads into invoice description and billing address fields, which are stored and rendered in client-facing emails and PDFs without escaping.README.md:96-128

Observables

Vulnerability Documentation

Payload withheldThe entire file describes a stored HTML injection vulnerability in PerfexCRM, including reproduction steps, impact, and mitigation.README.md:1-174