Description

A weakness has been identified in Azuriom CMS up to 1.2.12. This issue affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the component Money Transfer Handler. This manipulation causes time-of-check time-of-use. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. Upgrading to version 1.2.13 is capable of addressing this issue. Patch name: ae5596a9548e010a8a79838806eff60ef9554539. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-17T03:16:50.143Z",
  "pubdate": "2026-08-17T03:16:50.143Z",
  "executiveSummary": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability has been identified in Azuriom CMS up to version 1.2.12, specifically residing within the Money Transfer Handler component. This weakness arises during balance verification and transaction processing inside the transferMoney function of app/Http/Controllers/ProfileController.php. If successfully exploited, the flaw can lead to unauthorized financial transfers, integrity compromise of user balances, and potential economic disruption within the application environment. The attack vector is remote, enabling unauthorized entities to initiate exploitation across network boundaries. However, the exploitation complexity is characterized as high, and the overall exploitability is assessed as difficult due to the precise timing required to win the race condition window. The risk implication centers on unauthorized ledger manipulation and logic bypasses. Mitigation requires upgrading the affected software component to version 1.2.13 or applying the official vendor-supplied patch identified by the commit hash ae5596a9548e010a8a79838806eff60ef9554539.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a time-of-check to time-of-use (TOCTOU) synchronization flaw located in the money transfer logic of Azuriom CMS. The vulnerable component is the Money Transfer Handler, implemented within the transferMoney function inside the file app/Http/Controllers/ProfileController.php. Affected versions include all instances of Azuriom CMS up to version 1.2.12. The root cause stems from a lack of proper concurrency control, database transaction locking, or atomic operations during the validation of a user's monetary balance and the subsequent execution of the fund transfer. Specifically, the application checks if the sender possesses sufficient funds (the time-of-check) and later decrements the sender's balance and credits the recipient (the time-of-use) as distinct, non-atomic operations. Because these steps are separated in execution time without proper isolation levels or pessimistic locking mechanisms (such as SELECT ... FOR UPDATE), a window of vulnerability exists between the check and the update phases. Exploitation occurs when an attacker initiates multiple concurrent asynchronous requests targeting the transferMoney function. By flooding the application with parallel transfer requests before the initial balance deduction is finalized and committed to the database, the application repeatedly validates the same initial balance across multiple threads. This allows the attacker to transfer funds in excess of their actual balance, effectively duplicating currency or executing unauthorized financial transactions. The attack vector is remote, allowing malicious actors to interact with the application over standard network protocols without requiring pre-existing administrative privileges. Although the attack requires a high degree of technical complexity and precise timing synchronization to successfully win the race condition window, the post-exploitation impact includes severe financial inconsistency, database ledger corruption, and unauthorized resource acquisition within the CMS ecosystem."
}