CVE-2020-23974

Vulnerability

Create-Project Manager version 1.07 suffers from multiple persistent Cross-Site Scripting (XSS) and HTML injection vulnerabilities. The flaw exists in several input fields: the Online chat, Social feed, Message (title-tag), and Add new client (all-tags) forms. User-supplied input is not sanitized or encoded before being stored and later rendered, allowing arbitrary HTML and JavaScript to be injected. Affected version is 1.07, though the vendor's CodeCanyon page lists the current version as 1.6, possibly indicating the vulnerability may persist in later releases as well [1][2].

Exploitation

An attacker needs only to access the application and navigate to any of the vulnerable input fields (Online chat, Social feed, Message title-tag, Add new client all-tags). The attacker enters a malicious payload such as vvv or `` and submits the content. The payload is stored on the server and executed when any user (including administrators) views the affected page or receives the message. No special privileges or authentication are required on the part of the attacker, except that they must be able to reach the application's interface [1].

Impact

Successful exploitation leads to persistent XSS, which allows the attacker to execute arbitrary JavaScript in the context of any user who views the injected content. This can lead to session hijacking, theft of sensitive data, defacement, and other attacks against administrators and regular users. The impact is considered high due to the multi-vector nature and the fact that injection occurs in core communication and client management features [1].

Mitigation

As of the available references, no official patch or fixed version has been released. The vendor's page indicates version 1.6, but it is unclear whether this includes a fix. Users are advised to upgrade to the latest available version (1.6 or later) from the CodeCanyon page and verify that input sanitization is applied. As a workaround, a web application firewall (WAF) can be configured to block common XSS payloads. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2].