CVE-2022-22111: 
PHP vulnerability analysis and mitigation

CVE-2022-22111 is a security vulnerability discovered in DayByDay CRM version 2.2.0, disclosed on January 5, 2022. The vulnerability stems from missing authorization controls where any application user with update user permission can change the passwords of other users, including administrators, regardless of their role or department access (WhiteSource DB).

The vulnerability is classified as CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 8.8 (HIGH). The attack vector is Network-based with Low attack complexity, requiring Low privileges and No user interaction. The scope is Unchanged, with High impact on Confidentiality, Integrity, and Availability (NVD).

The vulnerability allows attackers to escalate their privileges to the highest level by changing administrator passwords. Any user with 'Update a User' permission can modify passwords of other users, including administrators, beyond their role and department access. This enables unauthorized access to administrative accounts and potentially full control of the application (WhiteSource DB).

The vulnerability has been patched in version 2.2.1 of both the 'bottelet/flarepoint' package and 'Bottelet/DaybydayCRM' repository. The fix implements proper authorization checks to ensure only admins, owners, or users themselves can change passwords (GitHub Patch).