CVE-2022-3000: 
PHP vulnerability analysis and mitigation

A stored Cross-site Scripting (XSS) vulnerability was identified in the YetiForce Customer Relationship Management system (yetiforcecompany/yetiforcecrm) affecting versions prior to 6.4.0. The vulnerability was discovered and disclosed in August 2022 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. An alternative assessment by huntr.dev assigned a CVSS score of 6.3 (Medium) with the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

The vulnerability could allow attackers to store and execute malicious scripts in the application, potentially leading to the compromise of user data and session information. The CVSS scores indicate moderate severity with potential impacts on both confidentiality and integrity of the system (NVD).

The vulnerability requires low attack complexity and low privileges to exploit, though some versions of the CVSS scoring indicate user interaction may be required. The vulnerability was reported through the huntr.dev platform (Huntr).

The vulnerability has been patched in version 6.4.0 of YetiForce CRM. Users are advised to upgrade to this version or later to mitigate the risk (GitHub).