Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.
PoC代码[已公开]
id: CVE-2026-41452
info:
name: Krayin CRM < 2.2.1 - Installer Authentication Bypass
author: str4k3r
severity: critical
description: |
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware caused by bypassing the CanInstall middleware redirect check via crafted HTTP POST requests, letting unauthenticated remote attackers overwrite the primary administrator account and gain full administrative access, exploit requires crafted HTTP POST with specific header.
impact: |
Unauthenticated attackers can gain full administrative access, compromising all CRM data and control.
remediation: |
Update to the latest version that patches this vulnerability.
reference:
- https://github.com/krayin/laravel-crm/releases
- https://github.com/krayin/laravel-crm/compare/v2.2.0...v2.2.1
classification:
cve-id: CVE-2026-41452
epss-score: 0.02454
epss-percentile: 0.83501
cwe-id: CWE-287
cvss-score: 9.8
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
metadata:
verified: true
max-request: 1
vendor: webkul
product: krayin-laravel-crm
fofa-query: title="Krayin" || header="krayin_crm_session"
tags: cve,cve2026,krayin,laravel,php,installer,auth-bypass
http:
- raw:
- |
GET /install HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains_all(tolower(body), "krayin", "installation", "installer")'
condition: and
# digest: 490a004630440220096946eb9c486f0e5ac8ffbc12f8ea2528ffee16e5da4880e0deac37ba6e9c6502201d011aad61e4a4933d20d11f3a8b07b9a6f5216a31db7e1044155995e276e103:922c64590222798bb761d5b6d8e72950