CRMEB Vulnerability Discovered, Remote Deserialization Exploit Possible

CVE-2024-6944

What is CVE-2024-6944?

A vulnerability exists in the CRMEB product developed by Xi'an Zhongbang Network Technology Co., specifically within the 'get_image_base64' function of the PublicController.php file. An attacker can manipulate the 'file' argument, resulting in deserialization of user-controlled data. This manipulation enables the possibility of executing arbitrary code or gaining unauthorized access to sensitive information via remote exploitation. Although notification was sent to the vendor regarding the vulnerability disclosure, no response was received. Organizations using affected versions of CRMEB should prioritize patching this vulnerability to mitigate potential security risks.

References