Unauthorized Approval in YShop CRM Back-Office

Executive Summary

This vulnerability in yshop-crm through version 2.1.3 allows any authenticated back-office user to approve or reject receivables records via the POST /admin-api/crm/contract-receivables/check endpoint without proper authorization checks. The handler lacks @PreAuthorize annotations and validation checks in the service layer are commented out, enabling attackers to manipulate records by ID and inflate contract return_money values or forge approval logs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP POST requests to /admin-api/crm/contract-receivables/check from non-admin users. Check for unauthorized approvals in the yshop_crm_contract_receivables and yshop_crm_contract tables. Use tools like curl to test the endpoint: curl -X POST -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"id":123}' http://<target>/admin-api/crm/contract-receivables/check

Inspect logs for repeated approval actions by low-privilege users. Verify if @PreAuthorize annotations are missing in CrmContractReceivablesController.java and if approval checks in CrmContractReceivablesServiceImpl.check are commented out.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to approve unauthorized receivables, inflate financial records, or manipulate contract amounts. This may lead to financial losses, inaccurate reporting, and compromised audit trails. The vulnerability requires only basic authentication, increasing the risk of misuse by insiders or compromised accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized financial adjustments and forging approval logs. It undermines data integrity and auditability, which are critical for GDPR (data accuracy) and HIPAA (audit controls). Organizations using affected versions may face regulatory penalties or loss of certification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade yshop-crm to a version beyond 2.1.3 where the vulnerability is patched. If upgrading is not possible, restrict access to /admin-api/crm/contract-receivables/check by IP or implement strict authentication. Review and uncomment approval checks in CrmContractReceivablesServiceImpl.check and add @PreAuthorize annotations in the controller.

Audit all receivables records for unauthorized approvals and revert any fraudulent changes. Monitor the endpoint for suspicious activity and implement database-level restrictions to prevent unauthorized modifications to return_money fields.

Useful 0 Not Useful 0