Invia #873105: CodenPlug TimeCamp Integration for RISE CRM v2.8 Access Control

A broken access control vulnerability exists in the contact update functionality of TimeCamp Integration for RISE CRM.

The application fails to properly verify authorization when updating contact records. The update endpoint accepts a user-controlled contact identifier (`contact_id`) and modifies the referenced contact without confirming that the authenticated user owns or has permission to modify that object.

Affected Endpoint:

POST /clients/save_contact/

Vulnerable Parameter:

contact_id

An authenticated attacker can modify the contact identifier value and submit a request targeting another user's contact record. The server processes the request successfully without enforcing object-level authorization checks.

Impact:

Successful exploitation may allow an authenticated user to modify other users' contact information, including:

* Name
* Email address
* Phone number
* Job title
* Gender
* Other contact profile fields

Security Impact:

* Unauthorized modification of user data
* Privacy violation
* Loss of data integrity
* Possible account-related impact if sensitive information is changed

Root Cause:

Missing server-side authorization validation and reliance on user-controlled object identifiers.

Remediation:

Implement proper object-level authorization checks before updating contact records. Verify that the authenticated user has permission to modify the referenced contact object and reject unauthorized requests with HTTP 403 Forbidden.

CWE:
CWE-639 Authorization Bypass Through User-Controlled Key

CVSS:
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

• Fonte: ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/19
• Utente: 4m3rr0r (UID 85795)
• Sottomissione: 29/06/2026 14:21 (2 mesi fa)
• Moderazione: 16/08/2026 09:33 (2 months later)
• Stato: Accettato
• Voce VulDB: 391143 [CodeCanyon TimeCamp Integration for CRM fino a 2.8 Contact Information Update /clients/save_contact contact_id escalationi di privilegi]
• Punti: 20