CyberRota Analysis
AI-GeneratedThe vulnerability affects the yshop-crm application, specifically in the CrmCustomerController, where insufficient authorization on the saveRedisSet and getRedisSet endpoints allows any authenticated back-office user to manipulate critical installation-wide settings. This could lead to severe consequences, including mass deletion of customer data, disruption of lead recycling processes, and prevention of new customer creation. Organizations using yshop-crm should prioritize addressing this issue to safeguard their customer data and operational integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.