Threat database

yshop-crm versions up to 2.1.3 contain an insecure direct object reference vulnerability that allows authenticated sales users to access, modify, or delete other users' customer records by supplying arbitrary IDs. This affects the get, update, delete, and do-open endpoints, enabling unauthorized enumeration and manipulation of customer data.

Yshopmall versions up to 2.0.0 have an insecure direct object reference vulnerability in the after-sales API. Authenticated users can access or modify other members' after-sales data by supplying their after-sales id and orderCode. This allows unauthorized viewing, tampering, or deletion of after-sales records via specific API calls.

Yshopmall versions up to 2.0.0 have an insecure direct object reference vulnerability in the member address API. Authenticated users can enumerate sequential address IDs to read, overwrite, or delete other members' shipping addresses, exposing personal information such as recipient names, phone numbers, and addresses.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the invoice approval API endpoint. Authenticated back-office users can approve or reject invoices without proper authorization checks due to missing @PreAuthorize annotations and commented-out approver validations. This allows bypassing the intended invoice approval workflow.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the back-office API endpoint POST /admin-api/crm/contract-receivables/check. This flaw allows any authenticated back-office user to approve or reject receivables records without proper permission checks, enabling unauthorized approval actions and forgery of approval logs.

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers can approve contracts to alter customer deal and purchase data or reject them to return products to stock.

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office credentials and a role with data scope ALL can retrieve the complete user directory including login names, nicknames, departments, email addresses, mobile numbers, and last login information.

yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office user to access approval workflow data. Attackers can retrieve approval chain topology, step ordering, approver identifiers, and personal information including login names, nicknames, departments, email addresses, mobile numbers and last login IP addresses.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability on the GET /admin-api/crm/operatelog/page endpoint. This flaw allows any authenticated back-office user to access the entire installation's audit logs without proper permission checks, exposing sensitive operational data such as operator names, IP addresses, User-Agent strings, request URLs, action details, and customer identifiers.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users to modify product sale status. Attackers can invoke the GET /admin-api/product/store-product/sale endpoint with sequential product IDs to withdraw entire product catalogs from sale or re-enable withdrawn products without proper permission checks.

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office users to issue arbitrary invoices. Attackers can call the PUT /admin-api/crm/invoice/issue endpoint without required permissions to modify invoice status, inflate contract invoiced amounts with attacker-chosen values, and trigger invoice emails to arbitrary addresses.

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy. Attackers can invoke these endpoints to manipulate shared Redis keys controlling customer auto-recycling behavior, causing mass customer data deletion, disabling lead recycling, or blocking customer creation across the deployment.

yshop-crm versions up to 2.1.3 have a missing authorization vulnerability in the sendSms and sendMail endpoints of the CrmCustomerController. This flaw allows any authenticated back-office user to send SMS and email messages to arbitrary customers without proper permission checks. The vulnerability enables unauthorized use of the organization's messaging channels.

A security flaw has been discovered in guchengwuyue yshopmall up to 1.9.1. This affects the function updateAvatar of the file /api/users/updateAvatar of the component co.yixiang.utils.FileUtil. Performing a manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument sort causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.