CVE-2025-10342: Perfex CRM Stored XSS Vulnerability

CVE-2025-10342 Overview

CVE-2025-10342 is a stored HTML injection vulnerability affecting Perfex CRM v3.2.1. The flaw exists in the /subscriptions/create endpoint, where the application fails to properly validate or sanitize user input submitted through the name parameter in POST requests. An unauthenticated attacker can inject arbitrary HTML markup that is stored server-side and later rendered to users viewing the affected subscription content. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and requires user interaction to trigger the malicious payload.

Critical Impact
Attackers can inject persistent HTML content that renders in victim browsers, enabling phishing, content spoofing, and potential integrity compromise of trusted CRM pages.

Affected Products

Perfex CRM v3.2.1
Vendor: perfexcrm
CPE: cpe:2.3:a:perfexcrm:perfex_crm:*:*:*:*:*:*:*:*

Discovery Timeline

2025-09-29 - CVE-2025-10342 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10342

Vulnerability Analysis

The vulnerability is a stored HTML injection flaw in Perfex CRM v3.2.1. Perfex CRM is a self-hosted customer relationship management application widely deployed by small and mid-size businesses. The /subscriptions/create endpoint accepts subscription details via POST requests, including a name parameter used to label the subscription entry. The application persists this value to the database and later renders it in the CRM interface without applying HTML entity encoding or tag stripping. When a legitimate user, such as a staff member or client, views the subscription list, the injected HTML executes in the context of the browsing session.

Stored HTML injection differs from reflected variants because the payload persists across sessions and affects every user who loads the compromised view. Although this vulnerability does not permit full script execution as a traditional Cross-Site Scripting (XSS) issue would, it still allows attackers to render fake login forms, misleading notices, or hyperlinks that redirect victims to attacker-controlled infrastructure.

Root Cause

The root cause is missing server-side input validation and missing output encoding on the name field submitted to /subscriptions/create. The application trusts user-supplied content and reflects it verbatim into HTML responses, violating the neutralization requirements defined by [CWE-79].

Attack Vector

Exploitation occurs remotely over the network with no authentication required, but a victim must load the page displaying the injected content for the payload to render. An attacker submits a crafted POST request to /subscriptions/create containing malicious HTML in the name parameter. See the INCIBE Security Notice on Perfex CRM Vulnerabilities for advisory details.

Detection Methods for CVE-2025-10342

Indicators of Compromise

POST requests to /subscriptions/create where the name parameter contains HTML tags such as <a>, <img>, <iframe>, or <form>.
Subscription records in the Perfex CRM database whose name fields contain raw HTML markup rather than plain text.
User reports of unexpected links, images, or login prompts appearing on subscription-related pages.

Detection Strategies

Inspect web server access logs for POST requests to /subscriptions/create with suspicious content lengths or encoded HTML entities in the request body.
Run database queries against Perfex CRM subscription tables to identify entries whose name column contains angle brackets or common tag names.
Deploy Web Application Firewall (WAF) rules that flag HTML tag patterns submitted to CRM endpoints not expecting markup.

Monitoring Recommendations

Enable verbose HTTP request logging on the Perfex CRM host and forward logs to a centralized SIEM for pattern analysis.
Alert on outbound redirects or DNS lookups originating from browser sessions that recently accessed subscription pages.
Track user-reported UI anomalies through a helpdesk workflow to surface stored injection incidents quickly.

How to Mitigate CVE-2025-10342

Immediate Actions Required

Audit the Perfex CRM subscription database and remove or sanitize any entries containing HTML markup in the name field.
Restrict access to /subscriptions/create to trusted networks or authenticated users until a patched release is deployed.
Notify staff and clients to report any unusual content or unexpected prompts appearing within the CRM interface.

Patch Information

As of the last NVD update on 2026-06-17, no vendor advisory or fixed version was linked in the CVE record. Administrators should monitor the INCIBE Security Notice on Perfex CRM Vulnerabilities and the Perfex CRM vendor channels for release notes addressing the name parameter handling in /subscriptions/create.

Workarounds

Deploy a WAF rule that rejects POST requests to /subscriptions/create when the name parameter contains <, >, or common HTML tag substrings.
Apply server-side input filtering in a reverse proxy to strip HTML tags from subscription form submissions before they reach the application.
Enforce a strict Content Security Policy (CSP) that disallows inline frames, forms with external actions, and remote image loading on CRM pages.

bash

# Example ModSecurity rule to block HTML tags in the 'name' parameter
SecRule REQUEST_URI "@streq /subscriptions/create" \
    "phase:2,chain,deny,status:403,id:1010342,msg:'CVE-2025-10342 HTML injection attempt'"
    SecRule ARGS:name "@rx <[a-zA-Z/][^>]*>" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"