← Advisories

Infor CRM 8.2.0.1136 Multiple HTML Script Injection Vulnerabilities

Medium
Advisory ID
ZSL-2016-5308
Release Date
26 February 2016
Vendor
Affected Version
8.2.0.1136
CVE
N/A
Tested On
Microsoft-IIS/8.5, ASP.NET/4.0.30319
Summary

InforĀ® CRM, formerly Saleslogix, is an award-winning customer relationship management (CRM) solution that provides a complete view of customer interactions, so your business can collaborate and respond promptly and knowledgably to customer inquiries, sales opportunities, and service requests. Infor CRM includes a robust suite of sales, marketing, and service capabilities, to offer businesses of all sizes a fast, flexible, and affordable solution for finding, winning, and growing profitable customer relationships.

Description

Infor CRM suffers from multiple stored cross-site scripting vulnerabilities. Input passed to several POST/PUT parameters in JSON format is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
21.01.2016Vulnerability discovered.
29.01.2016Vendor informed about a security issue.
29.01.2016Vendor promises to reply for more info.
13.02.2016No reply from the vendor.
14.02.2016Contact with the vendor.
25.02.2016No response from the vendor.
26.02.2016Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
26.02.2016Initial release
29.02.2016Added reference [3]
12.03.2016Added reference [4]