CVE-2025-60374

MEDIUM
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-60374 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC.

Description

Stored Cross-Site Scripting (XSS) in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A different vulnerability than CVE-2024-8867.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 15, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHubajansha/CVE-2025-60374Repository PoCby ajansha0Writeup1 file

5.1 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing a stored XSS vulnerability (CVE-2025-60374) in Perfex CRM's chatbot. It provides HTML/JavaScript payload examples as proof-of-concept snippets and discusses mitigation strategies, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a README.md documentation file describing CVE-2025-60374, a stored XSS vulnerability in Perfex CRM. It contains no executable code, no concealed payloads, and no instructions for the reviewer to perform harmful actions. The provided PoC examples are standard XSS demonstrations consistent with the described vulnerability.

ClassificationWriteup
Model confidence100%
AuthenticationRequired
Languagesmarkdownhtmljavascriptphp
Target softwarePerfex CRM
Attack typesstored cross-site scripting (xss)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of CVE-2025-60374, including vulnerability description, impact, proof-of-concept payload snippets, and mitigation guidance. It does not contain any standalone executable script, scanner, or automated exploitation tool. The PoC snippets are illustrative HTML/JavaScript fragments embedded in a markdown document, not functional exploit or scanner code.

README.md:1-155

Requirements

  • Attacker must be authenticated with low privileges to submit a chat message.README.md:32
  • A victim user must view the chat conversation containing the stored payload.README.md:15

Observed behavior

  • The writeup describes injecting HTML/JavaScript payloads into chat messages that are stored and later executed in other users' browsers.README.md:15
  • Example payloads include an image onerror handler, a button onclick handler, an iframe, a meter onmouseover handler, and a cookie-stealing fetch request.README.md:68-98
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Documentation
CVE-2025-60374The file documents a stored XSS vulnerability in Perfex CRM chatbot, including PoC examples and mitigation advice.README.md:1-155
Review boundaries

What the analysis did not establish

  • Only one file (README.md) was provided; no other repository files were inspected.
  • The artifact is a static markdown document; no dynamic behavior or execution context was observed.
  • The PoC payloads are presented as code blocks within the writeup and are not part of a runnable script.
  • Only the README.md file was provided; no other repository files were included in the evidence packet.
  • The analysis scope is limited to the supplied text; any binary or other files in the repository were not inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2