Zstore Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Zstore, now known as Zippy CRM, version 6.5.4. This vulnerability allows attackers to inject malicious scripts via unvalidated input parameters. By submitting crafted payloads into manual insertion points, attackers can execute arbitrary JavaScript in the context of the victim's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the 'Chat' page within the application. Insert a payload containing JavaScript into 'manual insertion point 1'. The injected script will be executed when the page is loaded, demonstrating the cross-site scripting vulnerability.