SQL Injection Vulnerability in CRMEB Up to Version 5.6.1
CVE-2025-15442
Key Information:
Badges
What is CVE-2025-15442?
A significant SQL injection vulnerability was identified in CRMEB, affecting versions up to 5.6.1. This issue arises from improper handling of the 'cate_id' argument within the /adminapi/export/product_list file, allowing attackers to execute unauthorized SQL commands. The vulnerability can be exploited remotely, enabling potential attackers to manipulate the database and extract sensitive information. Despite early disclosure to the vendor, there was no response, leaving systems vulnerable to exploitation. Ensuring the software is updated or implementing specific mitigations is essential to protect against this security risk.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
CRMEB 5.6.0
CRMEB 5.6.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved