High severity · published Jul 21, 2024
CVE-2024-6944
ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization
7.5
CVSS
3.8%
EPSS
No
On KEV
Description
A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function get_image_base64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
CRMEB · ZhongBangKeJi
5.0; 5.1; 5.2; 5.3; 5.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6944
Broken Link
https://gist.github.com/J1rrY-learn/93a0cf71894570f4eb39344161beb44c
Permissions Required
https://vuldb.com/?ctiid.272066
Permissions Required
https://vuldb.com/?id.272066
Third Party Advisory
https://vuldb.com/?submit.374413
More from CRMEB
8.8
CVE-2024-6943
ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization
8.1
CVE-2024-1704
ZhongBangKeJi CRMEB crud delete path traversal
5.3
CVE-2024-1703
ZhongBangKeJi CRMEB openfile absolute path traversal