Executive brief
Webkul Krayin CRM, a customer relationship management platform, is vulnerable to a security flaw where malicious code can be embedded in activity logs. An attacker with basic user access can create a 'Call' or 'Meeting' entry containing malicious scripts that execute when a manager or administrator views the activity. This could allow an attacker to hijack administrative sessions, steal sensitive customer data, or perform unauthorized actions on behalf of high-privileged users.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5 due to improper neutralization of user-supplied input in the 'comment' or 'description' fields during activity creation. Specifically, the '/admin/activities/create' endpoint fails to sanitize or escape HTML and JavaScript before rendering it in the administrative dashboard. An attacker with low-level privileges can inject malicious payloads into activity logs (such as 'Call' or 'Meeting' records). When a high-privileged user, such as a manager or administrator, views these activities as part of their normal workflow, the payload executes in their browser. This can lead to session hijacking via cookie theft, unauthorized data exfiltration, or account takeover. The issue is addressed in version 2.1.6 by implementing proper output encoding and input sanitization.
Affected products
- Webkul Krayin CRM 2.1.5
Timeline
- 2025-12-12: other: Initial fix pull request submitted
- 2025-12-29: patched: Version 2.1.6 released
- 2026-05-07: disclosed: CVE-2026-36341 published
- 2026-05-07: advisory: GitHub Advisory GHSA-j822-46r5-h4qx published