CVE-2025-10345: Perfex CRM XSS Vulnerability

CVE-2025-10345 Overview

CVE-2025-10345 is a stored HTML injection vulnerability affecting Perfex CRM v3.2.1. The flaw exists in the admin/leads/lead endpoint, where the application fails to properly validate user-supplied input in the name and address parameters submitted via HTTP POST. Attackers can inject arbitrary HTML markup that persists in the application and renders when other users view the affected lead record. The issue is classified under CWE-79, which covers improper neutralization of input during web page generation. Successful exploitation requires user interaction to trigger the injected content.

Critical Impact
Authenticated attackers can persistently inject HTML content into Perfex CRM lead records, enabling phishing, content spoofing, and defacement against users who view compromised leads.

Affected Products

Perfex CRM v3.2.1
Vendor: perfexcrm
CPE: cpe:2.3:a:perfexcrm:perfex_crm:*:*:*:*:*:*:*:*

Discovery Timeline

2025-09-29 - CVE-2025-10345 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10345

Vulnerability Analysis

CVE-2025-10345 is a stored HTML injection issue in Perfex CRM v3.2.1. The application accepts POST data submitted to the admin/leads/lead endpoint and stores it without applying output encoding or input sanitization. When a user later views the affected lead through the admin interface, the browser renders the attacker-supplied HTML as part of the page.

Unlike reflected injection, the stored nature of this flaw means a single malicious submission can affect every user who subsequently views the record. This creates opportunities for phishing content, fraudulent forms, hidden iframes, and misleading links embedded within an otherwise trusted CRM view.

The vulnerability is limited in scope by its impact profile: it affects integrity of displayed content but does not directly compromise confidentiality or availability. Exploitation requires network access to the application and interaction from a victim user who opens the injected lead.

Root Cause

The root cause is missing input validation and output encoding on the name and address form fields processed by the lead management module. The application treats these fields as trusted text and inserts them into rendered HTML without applying context-appropriate escaping such as HTML entity encoding.

Attack Vector

An attacker with the ability to submit or modify a lead sends a crafted POST request to admin/leads/lead. The name or address parameter contains HTML markup, for example anchor tags, form elements, or iframes. The payload is persisted in the database. When any user opens the lead, the browser parses the stored markup and renders it inline within the trusted CRM interface.

The vulnerability mechanism is described in the INCIBE Security Notice. No verified public proof-of-concept code has been released for this CVE.

Detection Methods for CVE-2025-10345

Indicators of Compromise

Lead records containing HTML tags such as <a>, <iframe>, <img>, <form>, or <script> in the name or address fields.
POST requests to admin/leads/lead where request body parameters contain angle brackets or URL-encoded HTML entities.
Unexpected outbound links or embedded content appearing in the CRM lead view for staff users.

Detection Strategies

Inspect web server access logs for POST requests to admin/leads/lead and correlate with request bodies stored by a web application firewall (WAF).
Query the Perfex CRM database for lead records whose name or address columns contain HTML tag patterns.
Deploy WAF signatures that flag HTML tags in fields expected to hold plain-text personal information.

Monitoring Recommendations

Enable full HTTP request logging on the Perfex CRM application server, including POST bodies where privacy policy permits.
Alert on user reports of unexpected pop-ups, redirects, or forms appearing within the CRM interface.
Review recently created or modified leads on a scheduled basis for anomalous markup content.

How to Mitigate CVE-2025-10345

Immediate Actions Required

Restrict access to the Perfex CRM administrative interface to trusted networks or VPN users until a patched version is deployed.
Audit existing lead records for injected HTML in the name and address fields and sanitize any affected entries.
Review user accounts with permission to create or edit leads and remove unnecessary privileges.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2025-10345. Administrators should monitor Perfex CRM release notes for a version newer than 3.2.1 that addresses HTML injection in the lead management module. Refer to the INCIBE Security Notice for coordinated advisory details.

Workarounds

Deploy a WAF rule that rejects POST requests to admin/leads/lead when the name or address parameters contain <, >, or common HTML tag substrings.
Configure a strict Content Security Policy (CSP) header on the CRM application to limit the impact of injected markup, for example blocking inline scripts and restricting frame sources.
Enforce server-side input validation on the reverse proxy layer using an allow-list of expected characters for name and address fields.

bash

# Example nginx rule to block HTML markup in lead submissions
location /admin/leads/lead {
    if ($request_method = POST) {
        set $block 0;
        if ($request_body ~* "(<|%3C)(script|iframe|img|a|form|svg)") { set $block 1; }
        if ($block = 1) { return 403; }
    }
    proxy_pass http://perfex_backend;
}