CVE-2024-36837

HIGHNuclei

CRMEB v.5.2.2 - SQL Injection

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-36837 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 6, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

crmeb

Browse crmeb / crmeb

Default status: unknown

CVE List5.2.2affected

Proofs of concept

2

Repository PoCs

GitHubphtcloud-dev/CVE-2024-36837Repository PoCby phtcloud-dev3Not analyzed2 files

2.6 KiB

GitHub
PoC details
GitHublhc321-source/CVE-2024-36837Repository PoCby lhc321-source2Not analyzed3 files

3.5 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHCRMEB v.5.2.2 - SQL Injection

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

Impact

Attackers can execute SQL injection via the selectId parameter in getProductList to obtain sensitive database information.

Remediation

Update CRMEB to a version later than 5.2.2 that patches the SQL injection vulnerability.

AuthorsDhiyaneshDk
Template tagscvecve2024crmebsqlivuln
CPE: cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*
FOFA: title="CRMEB"
https://github.com/phtcloud-dev/CVE-2024-36837 https://nvd.nist.gov/vuln/detail/CVE-2024-36837

Source: ProjectDiscovery

References

3