SQL Injection Vulnerability in CRMEB Product Export Functionality
CVE-2025-15443
Key Information:
Badges
What is CVE-2025-15443?
A security flaw has been discovered in CRMEB versions up to 5.6.1, specifically within the product export functionality located at /adminapi/product/product_export. This vulnerability enables an attacker to manipulate the cate_id parameter, leading to SQL injection attacks that can compromise the underlying database. The exploit can be executed remotely, allowing unauthorized access to sensitive information. Publicly available exploit code increases the severity of this risk, and the vendor has not responded to requests for remediation efforts.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
CRMEB 5.6.0
CRMEB 5.6.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved