CRM Vulnerability Lets Attackers Steal and Delete User Contacts

A critical Broken Object-Level Authorization (BOLA) vulnerability has been identified in Webkul Krayin CRM version 2.2.x. According to the National Vulnerability Database, this flaw resides in the /Contact/Persons/PersonController.php endpoint. It allows authenticated attackers to gain unauthorized access to sensitive contact information.

The National Vulnerability Database reports that attackers can exploit this weakness by sending a specially crafted GET request. Successful exploitation grants them the ability to read, modify, and even permanently delete any contact record, regardless of who originally owns it within the CRM. This poses a significant risk to data integrity and user privacy within organizations relying on this software.

With a CVSS score of 8.1 (HIGH), this vulnerability demands immediate attention. The National Vulnerability Database highlights that the exploit requires only low privileges (PR:L) and no user interaction (UI:N), making it relatively easy for a malicious actor to leverage once they have authenticated access to the system.