CVE-2025-10344: Perfex CRM Stored XSS Vulnerability

CVE-2025-10344 Overview

CVE-2025-10344 is a stored HTML injection vulnerability in Perfex CRM version 3.2.1. The flaw exists at the /projects/project/x endpoint, where the application fails to validate user input submitted through the name and clientid POST parameters. Attackers can inject arbitrary HTML markup that persists in the application and renders when other users view affected project pages. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation) and requires user interaction to trigger.

Critical Impact
Authenticated attackers can inject persistent HTML content into project records, enabling phishing overlays, content spoofing, and social engineering attacks against Perfex CRM users.

Affected Products

Perfex CRM v3.2.1
Perfex CRM (perfexcrm:perfex_crm) product line
Deployments exposing the /projects/project/x endpoint

Discovery Timeline

2025-09-29 - CVE-2025-10344 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10344

Vulnerability Analysis

The vulnerability resides in the project management functionality of Perfex CRM. When a user submits a POST request to /projects/project/x, the application accepts values for the name and clientid parameters without applying output encoding or input sanitization. The stored values are later rendered directly in the HTML response served to users who access the affected project view.

Because the injected content persists in the database, every subsequent viewer of the project page executes the attacker-controlled markup in their browser context. Successful exploitation requires the victim to visit the affected page, which aligns with the User Interaction: Passive attribute in the CVSS vector. The impact is limited to integrity of the rendered page content rather than confidentiality or availability of the CRM data.

Root Cause

The root cause is missing input validation and output encoding on the name and clientid POST parameters. The application treats user-supplied strings as safe HTML and reflects them into the DOM without escaping reserved characters such as <, >, and ". This pattern matches classic [CWE-79] stored cross-site scripting behavior, though the confirmed exploitation surface here is HTML injection.

Attack Vector

An attacker with access to submit project data sends a crafted POST request containing HTML payloads in the name or clientid fields. The payload is stored server-side and rendered on subsequent page loads. Exploitation requires no elevated privileges beyond the ability to submit project records and does not require additional authentication challenges beyond a valid session. The INCIBE advisory documents the affected endpoint and parameters. See the INCIBE Security Notice for technical details.

Detection Methods for CVE-2025-10344

Indicators of Compromise

POST requests to /projects/project/x containing HTML tags such as <img>, <script>, <iframe>, or event handlers in the name or clientid parameters
Project records in the Perfex CRM database whose name or clientid columns contain angle brackets or HTML entities
Outbound requests from browser sessions after users load project pages, indicating rendered payload execution
User reports of unexpected forms, banners, or redirects on project detail pages

Detection Strategies

Inspect web server access logs for POST traffic to /projects/project/x containing URL-encoded HTML characters (%3C, %3E, %22) in body parameters
Deploy Web Application Firewall rules that flag HTML tag patterns submitted to CRM project endpoints
Run database queries against project tables to identify stored values containing <, >, or on*= event handlers
Correlate authenticated user sessions with anomalous outbound HTTP requests originating from Perfex CRM domains

Monitoring Recommendations

Enable request logging with full POST body capture for the /projects/ route family
Alert on repeated write operations to project records from a single user session within short intervals
Monitor Content Security Policy (CSP) violation reports for inline script or style executions on CRM pages
Track help desk tickets referencing unexpected content or pop-ups within the CRM interface

How to Mitigate CVE-2025-10344

Immediate Actions Required

Restrict access to the Perfex CRM /projects/ interface to trusted, authenticated users through network controls or VPN
Audit existing project records for HTML content in the name and clientid fields and remediate any injected payloads
Enforce a strict Content Security Policy that disallows inline scripts and restricts loaded origins
Rotate session tokens for accounts that may have viewed compromised project pages

Patch Information

No vendor patch reference is listed in the NVD entry for CVE-2025-10344 at the time of publication. Administrators should consult the vendor directly and monitor the INCIBE Security Notice for updated remediation guidance and any fixed release announcements.

Workarounds

Apply a WAF rule that blocks HTML metacharacters in POST parameters submitted to /projects/project/x
Implement server-side input validation via a reverse proxy to strip or encode <, >, ", and ' before requests reach Perfex CRM
Limit project creation and editing permissions to a small set of trusted staff accounts until a vendor fix is available
Deploy browser-side controls such as CSP script-src 'self' and object-src 'none' to reduce exploitation impact

bash

# Example nginx reverse-proxy rule to block HTML tags in project POST parameters
location /projects/project/ {
    if ($request_method = POST) {
        if ($request_body ~* "(<|%3C)(script|img|iframe|svg|object)") {
            return 403;
        }
    }
    proxy_pass http://perfex_backend;
}