Ekushey Project Manager CRM vulnerabilities

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places, and the h4 occurrence is parsed as markup, allowing script execution. The login page is served without authentication, so the script runs for every visitor.

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.

Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.

Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.

Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.