Absolute Path Traversal Vulnerability in CRMEB 5.2.2
CVE-2024-1703

5.3MEDIUM

Key Information:

Vendor: Zhongbangkeji
Status: Crmeb
Vendor: CVE Published:; 21 February 2024

🔔 Create Zhongbangkeji Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-1703?

A vulnerability exists in ZhongBangKeJi CRMEB version 5.2.2 that allows attackers to exploit the openfile function located at /adminapi/system/file/openfile. This vulnerability enables absolute path traversal, potentially allowing malicious users to access sensitive files outside the intended directory structure. The exploit has been publicly disclosed, raising the risk of exploitation by unauthorized parties. Despite early notification of this issue, the vendor has not responded, highlighting the urgency for affected users to address potential security risks.

Affected Version(s)

CRMEB 5.2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1703 - Proof of Concept