Unauthorized fund transfer via race condition

Race condition in the Azuriom CMS money transfer handler before 1.2.13 allows remote authenticated users to transfer funds via concurrent requests. ProfileController::transferMoney in app/Http/Controllers/ProfileController.php verified the sender's balance before acquiring a database row lock, then performed the debit and credit later, so overlapping requests could pass the same pre-transfer check. Exploitation requires valid application access and tight timing, and the available evidence supports integrity impact to virtual account balances rather than code execution, disclosure, or service interruption.