Vulnerabilities

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API.

crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.

CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches.

CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages.

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0.

A vulnerability was found in crmeb crmeb_java 1.4.

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3.

A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3.

A weakness has been identified in CRMEB up to 5.6.3.

A security flaw has been discovered in CRMEB up to 5.6.3.

A vulnerability was identified in CRMEB up to 5.6.1.

A vulnerability was determined in CRMEB up to 5.6.1.

A vulnerability was identified in CRMEB up to 5.6.1.

A security flaw has been discovered in CRMEB up to 5.6.

A security vulnerability has been detected in CRMEB up to 5.6.1.

A weakness has been identified in CRMEB up to 5.6.1.

A security flaw has been discovered in CRMEB up to 5.6.1.

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information

CRMEB <=5.4.0 is vulnerable to Incorrect Access Control.

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.

A vulnerability has been found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical.

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

crmeb_java v1.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the mergeList method in class com.zbkj.front.pub.ImageMergeController.

SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.