Executive brief
Ekushey Project Manager CRM, a tool used for managing business projects and clients, contains a flaw in how it handles user accounts. An administrator can create multiple client accounts using the exact same email address, which causes the system to become confused during login. This can lead to 'account shadowing,' where a legitimate user is locked out of their account or an attacker gains access to the wrong account data, potentially disrupting business operations and compromising client privacy.
Technical details
A missing UNIQUE database constraint on the client email field in Ekushey Project Manager CRM (up to v5.0) allows for the creation of duplicate accounts. The authentication logic utilizes queries that match both email and password simultaneously (e.g., 'WHERE email = ? AND password = ?') rather than identifying users by a unique primary key. An authenticated administrator can exploit this to create a new account with the same credentials as an existing user, effectively shadowing the original account and rendering it inaccessible. If the duplicate accounts have different passwords, the system routes the login session based on the password provided, meaning user identity is incorrectly bound to the credential combination. This results in unauthorized account access and potential data corruption.
Affected products
- Creativeitem Ekushey Project Manager CRM 0 through 5.0
Timeline
- 2026-07-25: disclosed: Researcher disclosure by Aaron Amran Bin Amiruddin
- 2026-07-27: advisory: NVD and VulnCheck published advisory