ajansha/CVE-2025-60374

GitHubRepository PoCWriteup

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing a stored XSS vulnerability (CVE-2025-60374) in Perfex CRM's chatbot. It provides HTML/JavaScript payload examples as proof-of-concept snippets and discusses mitigation strategies, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a README.md documentation file describing CVE-2025-60374, a stored XSS vulnerability in Perfex CRM. It contains no executable code, no concealed payloads, and no instructions for the reviewer to perform harmful actions. The provided PoC examples are standard XSS demonstrations consistent with the described vulnerability.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
Languagesmarkdownhtmljavascriptphp
Target softwarePerfex CRM
Attack typesstored cross-site scripting (xss)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of CVE-2025-60374, including vulnerability description, impact, proof-of-concept payload snippets, and mitigation guidance. It does not contain any standalone executable script, scanner, or automated exploitation tool. The PoC snippets are illustrative HTML/JavaScript fragments embedded in a markdown document, not functional exploit or scanner code.

README.md:1-155

Requirements

  • Attacker must be authenticated with low privileges to submit a chat message.README.md:32
  • A victim user must view the chat conversation containing the stored payload.README.md:15

Observed behavior

  • The writeup describes injecting HTML/JavaScript payloads into chat messages that are stored and later executed in other users' browsers.README.md:15
  • Example payloads include an image onerror handler, a button onclick handler, an iframe, a meter onmouseover handler, and a cookie-stealing fetch request.README.md:68-98
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-60374The file documents a stored XSS vulnerability in Perfex CRM chatbot, including PoC examples and mitigation advice.README.md:1-155
Review boundaries

What the analysis did not establish

  • Only one file (README.md) was provided; no other repository files were inspected.
  • The artifact is a static markdown document; no dynamic behavior or execution context was observed.
  • The PoC payloads are presented as code blocks within the writeup and are not part of a runnable script.
  • Only the README.md file was provided; no other repository files were included in the evidence packet.
  • The analysis scope is limited to the supplied text; any binary or other files in the repository were not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1