Description
yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP addresses, User-Agent strings, request URLs, action details, and customer identifiers without proper permission checks.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guchengwuyue yshop-crm
Default version status: unaffected
0 to ≤ 2.1.3affected
pkg:github/guchengwuyue/yshop-crmReferences
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C07_crm_operatelog_page.py ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmoperatelog/CrmOperatelogController.java#L33 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/dal/mysql/crmoperatelog/CrmOperatelogMapper.java#L18 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30 ↗
- https://github.com/guchengwuyue/yshop-crm ↗
- https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crm-operation-log-listing ↗