Zhong Bang CRMEB PublicController.php get_image_base64 server-side request forgery
Published Jun 14, 2023
8.8
HIGHCVSS 3.1
EPSS 0.82%
Description
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
-
- Version 4.0StatusaffectedConstraints-
- Version 4.1StatusaffectedConstraints-
- Version 4.2StatusaffectedConstraints-
- Version 4.3StatusaffectedConstraints-
- Version 4.4StatusaffectedConstraints-
- Version 4.5StatusaffectedConstraints-
- Version 4.6StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Zhong Bang | Crmeb | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (3)
- https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md broken-linkexploitThird Party Advisory
- https://vuldb.com/?ctiid.231504 signaturepermissions-requiredPermissions RequiredThird Party Advisory
- https://vuldb.com/?id.231504 vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/HuBenLab/HuBenVulList/blob/main/CRMEB%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md | broken-linkexploitThird Party Advisory | |
| https://vuldb.com/?ctiid.231504 | signaturepermissions-requiredPermissions RequiredThird Party Advisory | |
| https://vuldb.com/?id.231504 | vdb-entrytechnical-descriptionPermissions RequiredThird Party Advisory |
Change history (0)
No recorded changes yet.