Zhong Bang

CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.

A vulnerability was found in crmeb crmeb_java 1.4.

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3.

A security flaw has been discovered in CRMEB up to 5.6.3.

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.

SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude and longitude parameters in the api/front/store/list component.

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4.

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API.

SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people.

A weakness has been identified in CRMEB up to 5.6.3.

A vulnerability was identified in CRMEB up to 5.6.1.

A vulnerability was found in ZhongBangKeJi CRMEB 5.2.2.

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages.

A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3.

A security flaw has been discovered in CRMEB up to 5.6.

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0.

A vulnerability was identified in CRMEB up to 5.6.1.

A vulnerability was determined in CRMEB up to 5.6.1.

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.

CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.

CRMEB v4.4 to v4.6 was discovered to contain an arbitrary file upload vulnerability via the component \attachment\SystemAttachmentServices.php.