Description
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| crmeb | CRMEB | ≤ 6.0.0 | — |
References
- GitHub Issue #119 issue-tracking
- https://github.com/crmeb/CRMEB product
- SystemRoleServices.php at v6.0.0 technical-description
- VulnCheck Advisory: CRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check third-party-advisory