Description
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| guchengwuyue | yshop-crm | ≤ 2.1.3 | — |
References
- Reporter proof of concept: audit-trail disclosure via /crm/operatelog/page exploit
- getOperatelogPage declared without @PreAuthorize at 2.1.3 technical-description
- selectPage builds twelve optional predicates, none referencing the caller technical-description
- Maven revision property showing the affected tree is version 2.1.3 technical-description
- yshop-crm source repository product
- VulnCheck Advisory: yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing third-party-advisory