{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awebkulkrayin_crm2.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webkul:krayin_crm:2.0.0:*:*:*:*:*:*:*","cpe:2.3:a:webkul:krayin_crm:2.1.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":3.5,"id":"CVE-2025-3568"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Krayin CRM (2.0.0, 2.1.0)"],"_cs_severities":["low"],"_cs_tags":["web-application","privilege-escalation","xss","csrf"],"_cs_type":"advisory","_cs_vendors":["Webkul"],"content_html":"\u003cp\u003eWebkul Krayin CRM versions 2.0.0 and 2.1.0 contain a vulnerability (CVE-2025-3568) that enables privilege escalation via malicious SVG file uploads. The application fails to properly sanitize uploaded SVG files, allowing attackers to embed malicious JavaScript. When an administrator views or interacts with the uploaded file, the script executes in the context of the admin's session. Combined with a lack of current password verification on the user profile update API endpoint, an attacker can perform a Cross-Site Request Forgery (CSRF) attack to overwrite the administrative account password. This vulnerability enables full account takeover and unauthorized access to sensitive customer relationship management data.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker (with low-privilege access) crafts a malicious SVG file containing an XSS payload designed to exfiltrate session tokens and initiate a password change request.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the malicious SVG file through a permitted CRM upload vector (e.g., email attachment or user profile media).\u003c/li\u003e\n\u003cli\u003eAttacker triggers the administrator to open or preview the SVG file, which renders in the admin's browser session.\u003c/li\u003e\n\u003cli\u003eThe embedded JavaScript in the SVG executes, capturing the administrator's CSRF/XSRF tokens from the browser session.\u003c/li\u003e\n\u003cli\u003eThe script generates an unauthorized background request to the user management API (\u003ccode\u003e/admin/settings/users/edit/[ID]\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application processes the request, which fails to verify the current administrative password.\u003c/li\u003e\n\u003cli\u003eThe administrator account password is changed to a value specified by the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the CRM using the newly set credentials to gain full administrative control.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative account takeover. Impacted sectors include businesses using Krayin CRM to manage customer, financial, and lead information. The attack allows for unauthorized data exfiltration, backdooring of the CRM instance, and potential lateral movement or persistence within the business environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch Webkul Krayin CRM to a non-vulnerable version immediately.\u003c/li\u003e\n\u003cli\u003eDisable the ability to upload or render SVG files within the CRM interface until a vendor patch is applied.\u003c/li\u003e\n\u003cli\u003eImplement strict Content Security Policy (CSP) headers to prevent the execution of inline scripts and unauthorized API requests from origin domains.\u003c/li\u003e\n\u003cli\u003eEnable server-side validation for all administrative user management actions, requiring current password re-authentication for all account profile changes.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect POST requests to administrative user management endpoints that lack necessary authentication context or originate from non-standard user agents.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-20T07:35:10Z","date_published":"2026-10-20T07:35:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-krayin-crm-xss/","summary":"CVE-2025-3568 allows an authenticated low-privileged user to perform an administrative account takeover in Krayin CRM 2.0.0 and 2.1.0 by leveraging SVG-based XSS to bypass password verification controls.","title":"Privilege Escalation in Webkul Krayin CRM via SVG XSS","url":"https://feed.craftedsignal.io/briefs/2026-10-krayin-crm-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:webkul:krayin_crm:2.1.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}