Executive brief
ChangeWeDer CRM is a customer relationship management system built with Spring Boot. A stored cross-site scripting (XSS) vulnerability in the customer save endpoint allows attackers to inject malicious JavaScript code through the customer name field, which is then stored and executed in the browsers of other users viewing customer records. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of affected users.
Technical details
The vulnerability is a stored XSS flaw in the Save Endpoint component, specifically in the file src/main/resources/public/js/customerServe/customer.serve.js. The root cause is inadequate input validation and output encoding on the customerName parameter submitted to /customer_serve/save and /sale_chance/save endpoints. An authenticated attacker can submit a POST request with XSS payload in the customerName field; the unsanitized input is stored in the database and then rendered without proper HTML escaping when the customer data is displayed to other users. No authentication bypass is required—the attacker must have legitimate access to the application. The vulnerability is publicly disclosed and exploitable, though not reported as actively exploited in the wild. The project maintainer has not yet responded to the issue report.
Affected products
- ChangeWeDer CRM up to c07bd4c97141521af6475034bc58523beed51bbd
Timeline
- 2026-08-20: disclosed: Vulnerability reported via GitHub issue
- 2026-09-16: advisory: CVE-2026-92418 published