Description
A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHPGurukul | Small CRM | 4.0 | — |
References
- VDB-339151 | PHPGurukul Small CRM edit-user.php authorization vdb-entry technical-description
- VDB-339151 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #727430 | PHPGurukul PHPGurukul Small Customer Relationship Management v4.0 Missing Authorization third-party-advisory
- https://github.com/rsecroot/Small-Customer-Relationship-Management-CRM-in-PHP/blob/main/Broken%20Access%20Control.md exploit
- https://phpgurukul.com/ product