Description
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 1Panel-dev | CordysCRM | ≤ 1.9.3 | — |
References
- Researcher Proof of Concept exploit
- Vulnerable Code (v1.9.3) technical-description
- VulnCheck Advisory: CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push third-party-advisory