Creativeitem Ekushey CRM Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Creativeitem's Ekushey CRM version 5.0. This issue arises from inadequate validation of user inputs in the 'description' parameter via POST requests to the project file upload endpoint. As a result, a remote attacker could craft a query to an authenticated user, potentially stealing their session cookie details.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.