CVE-2024-9030

Name of the Vulnerable Software and Affected Versions: CodeCanyon CRMGo SaaS version 7.2

Description: A problematic vulnerability was found in CodeCanyon CRMGo SaaS, affecting the file "/deal/{note id}/note". The manipulation of the notes argument leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. An attacker can inject scripts via the notes parameter.

Recommendations: For CodeCanyon CRMGo SaaS version 7.2, patch immediately and validate user input to prevent exploitation. As a temporary workaround, consider restricting access to the "/deal/{note id}/note" endpoint until a patch is available. Avoid using the notes parameter in the affected endpoint until the issue is resolved.