CVE-2025-10341: Perfex CRM Stored XSS Vulnerability

CVE-2025-10341 Overview

CVE-2025-10341 is a stored HTML injection vulnerability in Perfex CRM v3.2.1. The flaw exists in the company parameter of the /clients/client/x endpoint. The application fails to sanitize user-supplied input submitted via POST requests, allowing attackers to persist arbitrary HTML markup within the application. When another user renders the affected page, the injected content is served from the trusted origin. This weakness maps to [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction but no authentication or elevated privileges.

Critical Impact
Attackers can persist arbitrary HTML in the Perfex CRM client management interface, enabling phishing lures, UI redressing, and social engineering against staff and clients viewing the affected records.

Affected Products

Perfex CRM v3.2.1
Vendor: perfexcrm
Component: perfexcrm:perfex_crm

Discovery Timeline

2025-09-29 - CVE-2025-10341 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10341

Vulnerability Analysis

The vulnerability is a stored HTML injection in Perfex CRM v3.2.1. The company parameter accepted by the /clients/client/x endpoint is written to persistent storage without input validation or output encoding. When the affected client record is later rendered in the CRM interface, the browser parses the attacker-supplied markup as part of the page document object model.

HTML injection differs from full cross-site scripting because the classification here is limited to markup insertion rather than confirmed script execution. Attackers can still inject anchor tags, forms, iframes, and styled elements to conduct phishing, credential harvesting, and content spoofing from the trusted Perfex origin. The stored nature of the flaw means each visit to the tampered record re-delivers the payload to every user with view access.

Root Cause

The application does not enforce server-side validation of the company field before persistence. Output rendering does not apply contextual HTML encoding, allowing raw markup to reach the browser. Both the missing input filter and the missing output encoder contribute to the defect, aligning with [CWE-79].

Attack Vector

An unauthenticated remote attacker submits a crafted POST request containing HTML in the company parameter to /clients/client/x. The payload is stored server-side. A victim user viewing the affected client record then renders the malicious markup. The attack requires user interaction with the compromised record but no privileges on the target instance. See the INCIBE Security Notice on Vulnerabilities for the coordinated advisory.

Detection Methods for CVE-2025-10341

Indicators of Compromise

POST requests to /clients/client/x containing HTML tags such as <a>, <iframe>, <form>, <img>, or <script> in the company parameter.
Client records where the company name field contains unexpected markup, hyperlinks, or embedded external resources.
Outbound requests from user browsers to unfamiliar domains when viewing client records in Perfex CRM.

Detection Strategies

Inspect web application firewall and reverse proxy logs for POST bodies to /clients/client/x containing angle brackets or URL-encoded HTML entities.
Perform database audits on client tables for entries where the company column contains characters such as <, >, or href=.
Enable Content Security Policy reporting to surface unexpected inline content or third-party resource loads originating from CRM pages.

Monitoring Recommendations

Alert on anomalous POST payload sizes or non-printable characters submitted to Perfex CRM client endpoints.
Correlate authenticated CRM sessions viewing recently created or modified client records with outbound network traffic to newly registered domains.
Track failed login events or credential submissions immediately following views of specific client records to identify phishing chains.

How to Mitigate CVE-2025-10341

Immediate Actions Required

Restrict network exposure of the Perfex CRM administrative interface to trusted networks until a patched release is deployed.
Audit existing client records for HTML content in the company field and remove any unauthorized markup.
Enforce a strict Content Security Policy that disallows inline scripts, forms, and untrusted frame ancestors on CRM pages.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the INCIBE Security Notice on Vulnerabilities and the Perfex CRM release channel for a fixed version superseding v3.2.1. Apply updates as soon as they become available.

Workarounds

Deploy a web application firewall rule that rejects requests to /clients/client/x when the company parameter contains angle brackets or HTML entity encodings.
Add server-side input validation via a reverse proxy or middleware that strips HTML from client-supplied fields before they reach the application.
Educate CRM operators to treat hyperlinks and embedded content within client records as untrusted until the vulnerability is patched.

bash

# Example ModSecurity rule blocking HTML in the vulnerable parameter
SecRule REQUEST_URI "@beginsWith /clients/client/" \
    "chain,phase:2,deny,status:403,id:1010341,\
    msg:'CVE-2025-10341 Perfex CRM HTML injection attempt'"
    SecRule ARGS:company "@rx <[^>]+>" "t:none,t:urlDecodeUni"