Attack Chain

1. Attacker (with low-privilege access) crafts a malicious SVG file containing an XSS payload designed to exfiltrate session tokens and initiate a password change request.
2. Attacker uploads the malicious SVG file through a permitted CRM upload vector (e.g., email attachment or user profile media).
3. Attacker triggers the administrator to open or preview the SVG file, which renders in the admin's browser session.
4. The embedded JavaScript in the SVG executes, capturing the administrator's CSRF/XSRF tokens from the browser session.
5. The script generates an unauthorized background request to the user management API (/admin/settings/users/edit/[ID]).
6. The application processes the request, which fails to verify the current administrative password.
7. The administrator account password is changed to a value specified by the attacker.
8. Attacker logs into the CRM using the newly set credentials to gain full administrative control.

Impact

Successful exploitation results in full administrative account takeover. Impacted sectors include businesses using Krayin CRM to manage customer, financial, and lead information. The attack allows for unauthorized data exfiltration, backdooring of the CRM instance, and potential lateral movement or persistence within the business environment.

Recommendation

1. Patch Webkul Krayin CRM to a non-vulnerable version immediately.
2. Disable the ability to upload or render SVG files within the CRM interface until a vendor patch is applied.
3. Implement strict Content Security Policy (CSP) headers to prevent the execution of inline scripts and unauthorized API requests from origin domains.
4. Enable server-side validation for all administrative user management actions, requiring current password re-authentication for all account profile changes.
5. Deploy the provided Sigma rule to detect POST requests to administrative user management endpoints that lack necessary authentication context or originate from non-standard user agents.