Description
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 1Panel-dev | CordysCRM | < 1.9.2 | 1.9.2 |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (v1.9.1) technical-description
- Fix Commit (v1.9.2) patch
- VulnCheck Advisory: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort third-party-advisory