CyberRota Analysis
AI-GeneratedDjangoCRM contains a critical vulnerability due to the hardcoded SECRET_KEY in the webcrm/settings.py file, allowing attackers to forge valid session cookies, CSRF tokens, and password reset tokens, potentially leading to full account takeover, including superadmin access. Additionally, the default DEBUG=True setting exposes sensitive information such as database credentials and OAuth data through error pages. Organizations using DjangoCRM should prioritize immediate remediation to protect against unauthorized access and data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid session cookies (including for the superadmin account), forge CSRF tokens, and forge password reset tokens, achieving full account takeover.