CVE-2025-10343: Perfex CRM Stored XSS Vulnerability

CVE-2025-10343 Overview

CVE-2025-10343 is a stored HTML injection vulnerability affecting Perfex CRM v3.2.1. The flaw exists in the /expenses/expense endpoint, which fails to properly validate the expense_name parameter submitted via POST request. An attacker can inject arbitrary HTML markup that persists in the application and renders when other users view the affected page. This vulnerability is classified as [CWE-79] (Improper Neutralization of Input During Web Page Generation). Exploitation requires user interaction, such as an authenticated user viewing the crafted expense record. The issue was disclosed through INCIBE-CERT alongside other Perfex CRM vulnerabilities.

Critical Impact
Attackers can inject persistent HTML content into Perfex CRM expense records, enabling phishing overlays, content spoofing, and user redirection against authenticated CRM users.

Affected Products

Perfex CRM v3.2.1
Perfexcrm Perfex CRM (component perfexcrm:perfex_crm)
Endpoint /expenses/expense parameter expense_name

Discovery Timeline

2025-09-29 - CVE-2025-10343 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10343

Vulnerability Analysis

The vulnerability resides in the expense management workflow of Perfex CRM v3.2.1. When an authenticated user submits a new expense, the application accepts the expense_name field through a POST request to /expenses/expense without applying HTML entity encoding or input sanitization. The unsanitized value is later rendered directly in the HTML response when any user views the expense list or detail page. This behavior enables stored HTML injection, where attacker-controlled markup persists in the database and executes context-changing rendering on every subsequent view.

While the CVSS 4.0 vector indicates no direct confidentiality or integrity impact on the vulnerable system, it records a low integrity impact on subsequent systems. This aligns with client-side content manipulation such as fake login prompts, deceptive links, or injected forms targeting other CRM users.

Root Cause

The root cause is missing output encoding and inadequate server-side validation of the expense_name parameter. Perfex CRM stores raw user input and reflects it in HTML contexts without escaping characters such as <, >, and ". This absence of contextual sanitization allows arbitrary tags to be interpreted by the browser as legitimate page structure.

Attack Vector

An attacker with access to submit expenses sends a crafted POST request to /expenses/expense with an expense_name payload containing HTML markup. The payload is stored in the database and rendered whenever a CRM user browses the expense record. Exploitation requires user interaction (viewing the record) but no additional privileges beyond expense creation. See the INCIBE Security Notice for the complete advisory covering this and related Perfex CRM issues.

Detection Methods for CVE-2025-10343

Indicators of Compromise

Expense records containing raw HTML tags such as <form>, <iframe>, <a href>, or <img> in the expense_name field
POST requests to /expenses/expense where the expense_name parameter contains angle brackets or encoded HTML entities
User reports of unexpected login prompts, redirects, or visual artifacts on expense pages

Detection Strategies

Inspect the tblexpenses database table for stored values in the name column containing HTML tag patterns
Deploy a web application firewall rule that flags POST bodies to /expenses/expense matching expense_name=.*<[a-z]+
Review web server access logs for anomalous request bodies posted to the expenses endpoint by low-privilege accounts

Monitoring Recommendations

Enable audit logging on expense creation and modification events within Perfex CRM
Monitor outbound requests from browsers of CRM users for connections to unexpected external domains following expense page views
Alert on Content Security Policy (CSP) violation reports originating from /expenses/* paths

How to Mitigate CVE-2025-10343

Immediate Actions Required

Restrict expense creation privileges to trusted staff accounts until a patch is applied
Audit existing expense records for HTML markup in the expense_name field and remove malicious entries
Apply a strict Content Security Policy that disallows inline scripts and restricts framing on CRM pages

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Administrators should monitor the INCIBE Security Notice and the Perfex CRM vendor changelog for a version supersedes 3.2.1 addressing this issue.

Workarounds

Place Perfex CRM behind a WAF configured to strip or block HTML tags in POST parameters targeting /expenses/expense
Implement server-side input filtering that rejects <, >, and event handler attributes in the expense_name field
Enforce browser-side defenses via CSP headers such as Content-Security-Policy: default-src 'self'; script-src 'self'

bash

# Example NGINX rule to block HTML injection payloads on the vulnerable endpoint
location /expenses/expense {
    if ($request_method = POST) {
        if ($request_body ~* "expense_name=[^&]*(<|%3C)") {
            return 403;
        }
    }
    proxy_pass http://perfex_backend;
}