yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
guchengwuyue:yshop-crm
References 5
https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d…
Researcher Proof of Concept
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e…
Vulnerable Code
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e…
Vulnerable Code
https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e…
Permission Seed Data
https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorizat…
VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check