krayin — laravel-crm
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
Available for technologies you monitor inside Seraph CTI.
Surfaced automatically when a documented actor is linked to this CVE.
Shown when this vendor/product is relevant to your industry.
Campaign and indicator context, where Seraph analysts have published it.
Declare your technology stack inside Seraph CTI and get notified the moment a vulnerability matches it.
