CVE-2019-10226

CVE-2019-10226 describes an HTML injection vulnerability in Fat Free CRM v0.19.0. The issue resides in the comments functionality, where user-supplied input is not properly sanitized before being rendered. As a result, an authenticated user can submit arbitrary HTML tags, such as ` or `, which are then reflected in the comment view [2], [4].

To exploit this, an attacker must have a valid account on the CRM instance. They can then send a crafted POST request to the /comments endpoint with malicious HTML payload. The request must include a valid CSRF token, but the exploit-db PoC demonstrates the technique [4].

While the vendor disputes the severity because basic HTML formatting is allowed and an XSS protection mechanism is in place, the injection could still be used for phishing attacks or to alter the appearance of the page, potentially misleading users or leading to account compromise [2].

As of the report, the vulnerability was reported in v0.19.0. Users are advised to update to a later version or apply input validation to the comments feature. No official patch has been confirmed since the vendor considers the behavior acceptable [3].