Description
yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guchengwuyue yshop-crm
Default version status: unaffected
0 to ≤ 2.1.3affected
pkg:github/guchengwuyue/yshop-crmReferences
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_invoice_check.py ↗
- https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crminvoice/CrmInvoiceController.java#L72-L78 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crminvoice/CrmInvoiceServiceImpl.java#L219-L315 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/sql/yshop-crm-open-source.sql#L2597 ↗
- https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-invoice-check-endpoint ↗