Secur0 Cna

Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.16.0 **Description** An unrestricted file upload issue exists in the product photo upload feature. An authenticated user with the create product permission, such as the Seller role, can execute arbitrary JavaScript within the application origin. The system validates files based on magic bytes (content signatures) and only rejects a specific list of PHP extensions. However, the `ProductSaveController::save()` function uses the client-supplied extension when saving the file to the public web root. Consequently, a file containing an image header but using an HTML extension can be uploaded to `public/asset/upload/product/` and served as `text/html`, resulting in stored cross-site scripting (XSS), where a malicious script is permanently stored on the server and executed in the browser of users who view the file. **Recommendations** Update Roskus Prospero Flow CRM to version 5.16.0 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions 4.0.0 through 5.3.1 **Description** An authorization bypass exists in the supplier API that allows an authenticated user to read, modify, and reassign supplier records belonging to other companies to their own. This is achieved by sending a PUT request to the '/api/supplier/{id}' endpoint and manipulating the `company id` variable within the request body. **Recommendations** Update Roskus Prospero Flow CRM to a version later than 5.3.1. Restrict the use of the `company id` parameter in the '/api/supplier/{id}' endpoint to prevent unauthorized record reassignment.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.15.13 **Description** An issue exists in the company logo upload feature where the system fails to restrict the upload of dangerous file types. An authenticated user with permissions to create or update companies can upload an SVG document containing an embedded script element, leading to the execution of arbitrary JavaScript within the application origin. **Recommendations** Update Roskus Prospero Flow CRM to version 5.15.13 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 **Description** An authorization bypass exists in the transaction API that allows an authenticated user to read financial records belonging to other companies on the same instance. This occurs because the system fails to implement company scoping or permission checks when processing requests. The issue is triggered via an incremented identifier in the GET '/api/transaction/{id}' endpoint, specifically affecting the `id` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 **Description** An authorization bypass exists in the transaction save endpoint. A user with transaction and accounting creation permissions can disclose sensitive banking information from another company, including the bank account name, bank name, and the last four digits of a card. This occurs when a `bank account id` or `bank card id` belonging to another company is provided in the POST '/transaction/save' endpoint, as the system persists and renders the data without verifying company ownership. **Recommendations** Update Roskus Prospero Flow CRM to a version later than 5.14.0. As a temporary mitigation, restrict user permissions for transaction and accounting creation to trusted personnel only.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions 1.2.0 through 2.3.2 **Description** The report theme CSS sanitizer contains an incorrect behavior order where validation occurs before canonicalization. This allows an authenticated user to bypass the sanitizer blocklist using CSS hex escapes to reconstruct the `url()` function. Consequently, this can be used to force outbound HTTP requests from the browsers of other users, leading to the disclosure of their IP addresses and User-Agent strings. **Recommendations** Update maalfer Pentestify to a version later than 2.3.2.

**Name of the Vulnerable Software and Affected Versions** maalfer MailerUp versions prior to 1.1.3 **Description** An HTML injection issue exists in the public subscription form. Unauthenticated remote attackers can cause the application to send a message containing arbitrary HTML to a specified address, appearing to come from the form owner's configured sending identity. This occurs because the `first name` field of the subscription request is interpolated without escaping into the double opt-in verification email. **Recommendations** Update maalfer MailerUp to version 1.1.3 or later. As a temporary mitigation, restrict or sanitize the input of the `first name` field in the subscription form.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.15.9 **Description** The human resources component contains hard-coded credentials. Unauthenticated remote attackers can authenticate as any employee onboarded through the standard flow by providing only the employee's email address. This occurs because the employee save controller defaults to the password `changeme` and the onboarding form does not include a password field. **Recommendations** Update Roskus Prospero Flow CRM to version 5.15.9 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.15.10 **Description** An authorization bypass exists in the payroll module where the listing query is not scoped to the caller's company and the employee identifier is validated for global existence rather than company membership. This allows authenticated users with read payroll permissions to view salary and banking details of employees from any other company within the instance. Additionally, users with create payroll permissions can create payroll records attributed to employees of other companies. **Recommendations** Update Roskus Prospero Flow CRM to version 5.15.10 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.4.7 **Description** An authorization bypass exists in the product management component. Authenticated users can access sensitive data, including price, cost, stock, SKU, and barcode, belonging to other companies. Additionally, users can hijack products by reassigning the `company id` using the product's numeric identifier. This occurs because the `ProductUpdateController` does not extend `MainController`, resulting in a lack of authentication checks on the read endpoint. Furthermore, the `ProductRepository::save()` function uses `Product::find($data['id'])` to retrieve records without verifying if the product belongs to the authenticated user's company before updating the `company id` variable. **Recommendations** Update Roskus Prospero Flow CRM to version 5.4.7 or later.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 2.3.2 **Description** Cross-site Scripting occurs in the Markdown renderer when authenticated users provide a Markdown link containing a double quote in the URL. This character closes the anchor's href attribute because the sanitization process fails to escape quotes, allowing the execution of arbitrary JavaScript within the application origin. **Recommendations** Update maalfer Pentestify to version 2.3.2 or later.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 1.1.1 **Description** A stored cross-site scripting issue exists in the user management component. An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user by providing a crafted username. This occurs because the frontend uses the `escapeHTML()` function before inserting the username into the `onclick` attribute of the account deletion button. Since browsers HTML-decode attribute values before the JavaScript engine parses the handler, an encoded single quote (') can be used to break out of the string literal and inject malicious code that executes when the victim clicks the delete button. **Recommendations** Update to version 1.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 2.3.1 **Description** Authenticated users can execute arbitrary JavaScript within the application origin due to a Cross-site Scripting issue in the finding renderer. This occurs when HTML markup stored in the `severity` field of a finding is interpolated unescaped into class and style attributes during report rendering. **Recommendations** Update maalfer Pentestify to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.4.9 **Description** An authorization bypass exists in the ticket management component. Authenticated users can access, modify, or delete tickets belonging to other companies using the ticket's numeric identifier. This occurs because read and save operations do not restrict queries to the authenticated user's company. Additionally, the delete controller uses a generic `IlluminateHttpRequest` instead of the `TicketDeleteRequest`, which fails to enforce necessary permissions. This allows users to read full ticket content (title, description, and attachments), hijack tickets by reassigning the `company id` variable, or delete tickets without authorization. **Recommendations** Update Roskus Prospero Flow CRM to version 5.4.9 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.4.8 **Description** An authorization bypass exists in the contact management component. Authenticated users can overwrite contact data belonging to other companies or download personal data as a vCard by manipulating the contact's numeric identifier. This occurs because the save and export operations retrieve records without restricting the query to the company associated with the authenticated user. **Recommendations** Update Roskus Prospero Flow CRM to version 5.4.8 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.2.1 **Description** The permission management component contains a flaw where the permission save endpoint does not perform authorization checks. This allows any authenticated user to grant any role, including their own, the full set of application permissions by sending a crafted POST request to the endpoint, which then synchronizes the submitted permissions to the specified role. **Recommendations** Update to version 5.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.3.7 **Description** Authenticated users with permissions to create or update leads can execute arbitrary JavaScript within the application origin. This occurs in the lead index view when HTML markup stored in the lead name field is rendered using Blade's unescaped output directive and placed inside a JavaScript string literal within an `onclick` attribute. **Recommendations** Update Roskus Prospero Flow CRM to version 5.3.7 or later.

**Name of the Vulnerable Software and Affected Versions** maalfer Pentestify versions prior to 1.1.0 **Description** An issue in the PDF export component allows authenticated users to trigger outbound HTTP GET requests from the server to arbitrary destinations. This occurs because the server-side headless browser fetches unvalidated URLs stored in the `finding images` field or the `report client logo` field during report rendering. Server-Side Request Forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location. **Recommendations** Update maalfer Pentestify to version 1.1.0 or later. Restrict the use of the `finding images` and `report client logo` fields to trusted sources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Roskus Prospero Flow CRM versions prior to 5.4.4 **Description** The email module contains a stored cross-site scripting issue. A remote, authenticated user with low privileges can execute arbitrary JavaScript in the browser of another user, including administrators, by storing a malicious payload in an email body. This occurs because the email body is persisted without sanitization and rendered unescaped using `{!! $email->body !!}` when the recipient opens the message, which can lead to session compromise and account takeover. **Recommendations** Update Roskus Prospero Flow CRM to version 5.4.4 or later.