Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.