Description
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations or orders to alter their approval status and read approval details.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
1Panel-dev CordysCRM
Default version status: unaffected
0 to ≤ 1.9.3affected
pkg:github/1Panel-dev/CordysCRMReferences
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_approval_resource_push.py ↗
- https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/approval/controller/ApprovalResourceController.java#L32-L43 ↗
- https://www.vulncheck.com/advisories/cordyscrm-through-1.9.3-missing-authorization-via-approval-resource-push ↗