SQL Injection Vulnerability in CRMEB_Java E-commerce System by ZhongBangKeJi
CVE-2024-28714

8.1HIGH

Key Information:

Vendor

ZhongBangKeJi

Status
CRMEB_Java
Vendor
CVE Published:
28 March 2024

What is CVE-2024-28714?

The CRMEB_Java e-commerce system version 1.3.4 is vulnerable to an SQL Injection attack that enables unauthorized execution of arbitrary code through manipulation of the 'groupid' parameter. This vulnerability poses significant risks, allowing potential attackers to compromise the integrity of the system, gain unauthorized access to sensitive data, or execute malicious actions. It is essential for organizations using this platform to implement immediate security measures to mitigate potential threats.

References

https://gitee.com/ZhongBangKeJi/crmeb_java
https://github.com/JiangXiaoBaiJia/cve2/blob/main/a.png
https://github.com/JiangXiaoBaiJia/cve2/blob/main/1.md

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.