Description
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| crmeb | CRMEB | ≤ 6.0.0 | — |
References
- GitHub Issue #120 issue-tracking
- https://github.com/crmeb/CRMEB product
- MessageSystemController.php at v6.0.0 technical-description
- VulnCheck Advisory: CRMEB through 6.0.0 Unauthorized Message Modification via edit_message third-party-advisory