CVE-2022-22113
📋 TL;DR
DayByDay CRM versions 2.2.0 through 2.2.1 have an insufficient session expiration vulnerability where users remain logged in after password changes. This allows unauthorized access if credentials are compromised and then changed. All users of affected versions are impacted.
💻 Affected Systems
- DayByDay CRM
📦 What is this software?
Daybyday by Daybydaycrm
⚠️ Risk & Real-World Impact
Worst Case
An attacker with stolen credentials maintains persistent access even after the legitimate user changes their password, leading to complete account takeover and potential data exfiltration.
Likely Case
Legitimate users who change passwords remain vulnerable to session hijacking from previous compromised sessions, allowing unauthorized access to CRM data.
If Mitigated
With proper session invalidation, password changes immediately terminate all existing sessions, preventing unauthorized access.
🎯 Exploit Status
Exploitation requires initial credential compromise but is trivial once achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch exists. Modify session.php to invalidate sessions on password change.
🔧 Temporary Workarounds
Manual Session Invalidation
allModify session configuration to invalidate sessions when passwords change
Edit config/session.php line 32 to implement session regeneration on password change
🧯 If You Can't Patch
- Implement mandatory session timeouts (e.g., 15-30 minutes)
- Monitor for unusual session activity and force logout suspicious sessions
🔍 How to Verify
Check if Vulnerable:
Check if config/session.php lacks session invalidation logic for password changesCheck Version:
Check DayByDay CRM version in admin panel or package.jsonVerify Fix Applied:
Test that changing a password immediately logs out all existing sessions📡 Detection & Monitoring
Log Indicators:
- Multiple active sessions for same user after password change
- Session IDs persisting beyond password reset
Network Indicators:
- Unusual session duration patterns
SIEM Query:
session.user_id AND event_type:password_change AND NOT event_type:session_invalidation