Ekushey CRM CVE-2025-40991

Exploitation requires an authenticated account with access to the client project-file upload feature (/ekushey/index.php/client/project_file/upload/xxxx) to submit a crafted 'description' value via POST (PR:L). Because the payload is stored, a second authenticated user must subsequently view the poisoned description for the script to fire (UI:P) - the attacker cannot self-trigger impact. Limiting factors: this is not remote-unauthenticated (a valid login is needed), success depends on luring or waiting for a higher-value user to open the affected record, and impact is confined to that victim's browser session (cookie/session theft) rather than direct server or data compromise.

This is a genuinely medium/low-priority issue, and the signals are internally consistent rather than conflicting. The CVSS 4.0 base score is 5.1 (Medium), and the vector tells a modest story: although the attack vector is network (AV:N) with low complexity (AC:L), exploitation requires an already-authenticated account (PR:L) and victim interaction (UI:P) - a logged-in user must view the attacker-poisoned 'description' field. Impact is limited to subsequent-system confidentiality and integrity (SC:L/SI:L) with no impact on the vulnerable application itself (VC:N/VI:N/VA:N), reflecting classic session-cookie theft rather than direct server compromise. The EPSS score of 0.03% (9th percentile) is very low, and there is no CISA KEV listing and no public exploit identified, so there is no evidence of real-world or opportunistic exploitation. No signals conflict here: a Medium CVSS, near-zero EPSS, absent KEV, and a niche product all point the same direction. The main caveat is sourcing - the only references are an INCIBE-CERT bulletin and an NVD detail page, with no independent vendor advisory confirming a fix, so patch availability is unverified.

An authenticated low-privilege user of Ekushey CRM uploads or edits a project file and injects a malicious script into the 'description' POST parameter at /ekushey/index.php/client/project_file/upload/xxxx. When another authenticated user (e.g. an administrator or project manager) later views that stored description, the script executes in their browser and exfiltrates their session cookie. No public exploit code has been identified at time of analysis.