Worksuite HR, CRM 和项目管理存在跨站脚本漏洞

Successful exploitation of CVE-2026-4165 allows an attacker to inject arbitrary JavaScript code into the Worksuite HR, CRM and Project Management application. This can lead to a variety of malicious outcomes, including session hijacking, defacement of the application's user interface, and theft of sensitive user data such as login credentials, personal information, and financial details. The attacker could potentially gain unauthorized access to user accounts and perform actions on their behalf. Given the nature of HR, CRM, and project management systems, the data at risk includes highly confidential employee records, customer data, and project-related information, making this a significant concern for organizations using this software.

Organizations utilizing Worksuite HR, CRM and Project Management versions 5.5.0 through 5.5.25 are at risk. This includes businesses of all sizes that rely on this software for managing human resources, customer relationships, and project workflows. Shared hosting environments where multiple users share the same instance of the software are particularly vulnerable, as an attacker could potentially compromise the entire environment through a single vulnerable application.

• generic web:

curl -s -X POST "http://<target>/account/orders/create" -d "Client Note=<script>alert('XSS')</script>" | grep "alert('XSS')"

• generic web:

curl -s -X GET "http://<target>/account/orders/create?Client Note=<script>alert('XSS')</script>" | grep "alert('XSS')"

1. 2026-03-15Disclosure

   disclosure

1. 已保留2026-03-14
2. 发布日期2026-03-15
3. 修改日期2026-03-17
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-4165 is to upgrade Worksuite HR, CRM and Project Management to a version that includes the security patch. Until an upgrade is possible, consider implementing input validation and sanitization on the 'Client Note' field to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS attacks can provide an additional layer of protection. Regularly review application logs for suspicious activity, particularly requests to the /account/orders/create endpoint with unusual parameters. After upgrade, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the Client Note field and verifying that it is properly sanitized.