YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number

Description

References

• nvd.nist.gov/vuln/detail/CVE-2021-4111 · ADVISORY
• yetiforcecompany/yetiforcecrm commit c1ad711 · WEB
• yetiforcecompany/yetiforcecrm · PACKAGE
• huntr.dev/bounties/8afc8981-baff-4082-b640-be535b29eb9a · WEB

yetiforce/yetiforce-crm의 다른 취약점

• CVE-2023-49508보통 6.5Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtai…
• CVE-2022-3002보통 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3005보통 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3004보통 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
• CVE-2022-3000보통 5.4Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.