CyberRota Analysis
AI-GeneratedKrayin CRM 2.2.4 is vulnerable due to a missing authentication flaw in its installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account by exploiting a crafted HTTP POST request. This vulnerability enables attackers to gain full administrative access to all CRM data by supplying arbitrary credentials. Organizations using this CRM version should prioritize immediate remediation to prevent potential unauthorized access and data breaches.
Original NVD Description
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.