Daybydaycrm
Monthly
Missing admin-only middleware on DaybydayCRM's SettingsController (`updateOverall` and `updateFirstStep` methods) allows any authenticated low-privilege user to modify critical company-wide configurations - including currency, VAT rates, invoice numbering, and business hours - in versions up to 2.2.1. The PR diff confirms the vulnerability is part of a systemic authorization failure across multiple controllers: authenticated users could also delete any resource (clients, tasks, leads, projects) and exploit mass assignment flaws in status update endpoints. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though an upstream patch PR has been submitted.
Insecure Direct Object Reference in Bottelet DaybydayCRM up to version 2.2.1 allows any authenticated user to view or download arbitrary documents belonging to other users by enumerating the external_id URL parameter in DocumentsController. The missing authorization check in both the view() and download() methods means a low-privilege employee or contractor can exfiltrate documents linked to any Task, Project, Lead, or Client within the CRM. No public exploit identified at time of analysis and no CISA KEV listing, but the attack is trivially executable by any authenticated user given low complexity (AC:L, AT:N) and no user interaction required (UI:N).
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing admin-only middleware on DaybydayCRM's SettingsController (`updateOverall` and `updateFirstStep` methods) allows any authenticated low-privilege user to modify critical company-wide configurations - including currency, VAT rates, invoice numbering, and business hours - in versions up to 2.2.1. The PR diff confirms the vulnerability is part of a systemic authorization failure across multiple controllers: authenticated users could also delete any resource (clients, tasks, leads, projects) and exploit mass assignment flaws in status update endpoints. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though an upstream patch PR has been submitted.
Insecure Direct Object Reference in Bottelet DaybydayCRM up to version 2.2.1 allows any authenticated user to view or download arbitrary documents belonging to other users by enumerating the external_id URL parameter in DocumentsController. The missing authorization check in both the view() and download() methods means a low-privilege employee or contractor can exfiltrate documents linked to any Task, Project, Lead, or Client within the CRM. No public exploit identified at time of analysis and no CISA KEV listing, but the attack is trivially executable by any authenticated user given low complexity (AC:L, AT:N) and no user interaction required (UI:N).
Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.