Internet Web Solutions Sublime CRM HTTP POST Request inicio.php cross site scripting

Successful exploitation of CVE-2025-1360 allows an attacker to inject arbitrary JavaScript code into the Sublime CRM application. This can lead to various malicious outcomes, including session hijacking, phishing attacks, and defacement of the CRM interface. An attacker could potentially steal sensitive customer data stored within the CRM, such as contact information, sales records, and financial details. The impact is amplified if the CRM is integrated with other systems, as the attacker could potentially gain access to those systems as well. The vulnerability's remote accessibility increases the risk of widespread exploitation.

Organizations using Sublime CRM, particularly those with sensitive customer data stored within the system, are at risk. Shared hosting environments where multiple clients share the same server instance are especially vulnerable, as a compromise of one client's CRM instance could potentially impact others. Legacy configurations with outdated security settings may also increase the risk.

• php: Examine /crm/inicio.php for unsanitized handling of the 'msg_to' parameter. Search for instances of echo or print statements directly outputting user input without proper encoding.

// Example of vulnerable code
<?php
echo $_POST['msg_to'];
?>

• generic web: Monitor access logs for unusual POST requests to /crm/inicio.php with suspicious values in the 'msg_to' parameter. Look for patterns indicative of XSS payloads (e.g., <script>).

grep 'msg_to=[^a-zA-Z0-9]' /var/log/apache2/access.log

• generic web: Check response headers for signs of XSS injection. Use browser developer tools to inspect the HTML source code for unexpected JavaScript code. • generic web: Use curl to test the endpoint with a simple XSS payload:

curl -X POST -d "msg_to=<script>alert('XSS')</script>" http://your-sublime-crm-url/crm/inicio.php

1. 2025-02-16Disclosure

   disclosure

2. 2025-02-16Patch

   patch

1. Reservado2025-02-15
2. Publicada2025-02-16
3. Modificada2025-02-18
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2025-1360 is to upgrade Sublime CRM to version 20250207.0.1 or later. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the 'msgto' parameter within the /crm/inicio.php file to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security policies and procedures to prevent similar vulnerabilities in the future. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the 'msgto' parameter and verifying that it is properly sanitized.