CVE-2019-14547

Description:
During the assessment, it was observed that the Attachment name in the Attchement details suffers from a Stored XSS attack. The attacker can load malicious javascript in the attachment name while sending the mail. The XSS payload inside the attachment name fires when the admin loads the list of attachments in the URL http://localhost/EspoCRM-5.6.8/#Attachment. Once the admin clicks the attachment with the malicious payload, the javascript fires. This link can be sent to any user of the application and is available for all and hence can form xss to all. The attachment name doesn’t have proper XSS validation in place which helps execute the malicious javascript and hence gain the cookies of the victim. With this cookie the attacker can log in to victims account and basically have complete takeover of his account and perform malicious actions on his behalf.