CyberRota Analysis
AI-GeneratedThe vulnerability in CRMEB allows unauthorized users, including sub-administrators and accounts without roles, to bypass authentication and access restricted admin endpoints due to a flaw in the verifyAuth() method of SystemRoleServices.php. This could lead to unauthorized data exposure and potential system compromise. Organizations using CRMEB should prioritize patching this vulnerability to safeguard their administrative interfaces and sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.