Krayin
Monthly
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
Administrative account takeover in Krayin CRM (Laravel CRM) 2.2.4 lets unauthenticated remote attackers overwrite the primary admin account by POSTing to the installer's admin-config-setup endpoint with an X-Requested-With: XMLHttpRequest header that defeats the CanInstall middleware redirect. Reported by VulnCheck with a publicly available exploit, it carries a 9.3 CVSS 4.0 and grants full control over all CRM data. There is no public exploit identified as actively exploited in CISA KEV, but working exploit code exists.
Broken object-level authorization in Krayin CRM (Laravel CRM) through version 2.2.3 lets any authenticated user tamper with leads, persons, organizations, quotes, and activities belonging to other users. Because the edit, update, and destroy methods across five controllers never verify record ownership, a low-privileged account can read, modify, reassign, or delete arbitrary CRM records by manipulating the object ID. Publicly available exploit details exist (reported by VulnCheck), though the issue is not listed in CISA KEV and no EPSS score was provided.
Stored cross-site scripting (XSS) in Krayin Laravel-CRM up to version 2.2 allows authenticated users with low privileges to inject malicious scripts via the composeMail function in the Activities/Notes Module, which are then executed when other users view the content. The vulnerability requires user interaction (UI:P) but has confirmed publicly available exploit code and a vendor-released patch (commit 73ed28d466bf14787fdb86a120c656a4af270153), making it a moderate priority for deployments where multiple users interact with notes and mail features.