BusinessNext CRMnext Arbitrary Code Execution Vulnerability

A remote code execution vulnerability has been identified in BusinessNext CRMnext version 10.8.3.0. The issue arises in the Applications Page, where the comments input parameter can be manipulated to execute arbitrary code. This vulnerability requires authentication, as it can only be exploited by users with access to the Applications Page.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, log in to CRMnext with a valid account. Navigate to the Applications Page and either modify an existing application or submit a new one. Inject the payload into the comments section and submit the request. The page content will be updated without proper validation, indicating that the injected code has been executed.