An arbitrary file upload vulnerability in Webkul Krayin CRM v2.2.x allows authenticated attackers to achieve remote code execution, presenting a critical risk to system integrity.

This is an arbitrary file upload vulnerability located in the /admin/tinymce/upload endpoint. It requires the attacker to have authenticated access to the administrative interface to upload and execute malicious PHP files.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server. This results in a complete compromise of the application, potentially leading to unauthorized data access, modification of business records, and full system takeover. The CVSS score of 9.9 reflects the high potential for impact on confidentiality, integrity, and availability.

Immediate Action: Update Krayin CRM to the latest available version provided by Webkul to patch the file upload validation logic.

Proactive Monitoring: Monitor server access logs for unusual requests to the /admin/tinymce/upload directory and inspect for unexpected file creations in web-accessible directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict file uploads and block requests containing suspicious file extensions or non-authorized content types in the upload endpoint.

Public Exploit Available: Yes — a public exploit exists in ExploitDB and multiple proof-of-concept repositories on GitHub.

Given the availability of weaponized exploits and the critical nature of remote code execution, organizations using Krayin CRM v2.2.x must prioritize upgrading to the latest version immediately. Failure to patch will leave the infrastructure vulnerable to total system compromise by any authenticated user.