CVE-2021-40303

This exploit demonstrates a stored XSS vulnerability in perfexcrm 1.10 by injecting malicious JavaScript into the 'state' parameter of a profile update request. The payload is executed when another user views the profile page.

The repository contains a functional proof-of-concept for CVE-2021-40303, demonstrating a stored XSS vulnerability in Perfex CRM 1.10 via the `/clients/profile` endpoint. The PoC includes a crafted HTTP POST request with malicious input in the `state` parameter, which triggers an XSS payload when the profile page is viewed.