Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM prior to 6.3.4 allows a standard authenticated user to use administrative controllers.
dimo-crm yellowbox crm