Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| guchengwuyue | yshop-crm | ≤ 2.1.3 | — |
References
- Reporter proof of concept: unauthorized invoice issuance via /crm/invoice/issue exploit
- issueInvoice declared without @PreAuthorize at 2.1.3 technical-description
- issueInvoice trusts the request body for the contract amount with no ownership check technical-description
- Maven revision property showing the affected tree is version 2.1.3 technical-description
- yshop-crm source repository product
- VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice third-party-advisory