| タイトル | CodenPlug TimeCamp Integration for RISE CRM v2.8 Access Control |
|---|
| 説明 | A broken access control vulnerability exists in the contact update functionality of TimeCamp Integration for RISE CRM.
The application fails to properly verify authorization when updating contact records. The update endpoint accepts a user-controlled contact identifier (`contact_id`) and modifies the referenced contact without confirming that the authenticated user owns or has permission to modify that object.
Affected Endpoint:
POST /clients/save_contact/
Vulnerable Parameter:
contact_id
An authenticated attacker can modify the contact identifier value and submit a request targeting another user's contact record. The server processes the request successfully without enforcing object-level authorization checks.
Impact:
Successful exploitation may allow an authenticated user to modify other users' contact information, including:
* Name
* Email address
* Phone number
* Job title
* Gender
* Other contact profile fields
Security Impact:
* Unauthorized modification of user data
* Privacy violation
* Loss of data integrity
* Possible account-related impact if sensitive information is changed
Root Cause:
Missing server-side authorization validation and reliance on user-controlled object identifiers.
Remediation:
Implement proper object-level authorization checks before updating contact records. Verify that the authenticated user has permission to modify the referenced contact object and reject unauthorized requests with HTTP 403 Forbidden.
CWE:
CWE-639 Authorization Bypass Through User-Controlled Key
CVSS:
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
|
|---|
| ソース | ⚠️ https://github.com/4m3rr0r/PoCVulDb/issues/19 |
|---|
| ユーザー | 4m3rr0r (UID 85795) |
|---|
| 送信 | 2026年06月29日 14:21 (2 月 ago) |
|---|
| モデレーション | 2026年08月16日 09:33 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 391143 [CodeCanyon TimeCamp Integration for CRM 迄 2.8 Contact Information Update /clients/save_contact contact_id 特権昇格] |
|---|
| ポイント | 20 |
|---|