References https://nvd.nist.gov/vuln/detail/CVE-2024-52726 https://github.com/advisories/GHSA-62x5-4rjc-x8j3 https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/CRMEB/CRMEB%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BD%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90(CVE-2024-52726).md https://ddpoc.com/DVB-2025-8958.html https://cn-sec.com/archives/3899332.html https://gist.github.com/sec-Kode/bb71138619b22de28c6b0ba986ad58e5 https://github.com/iSee857/CVE-PoC/blob/main/CRMEB_CVE-2024-52726_ReadAnyFile.py https://cve.imfht.com/detail/CVE-2024-52726 https://www.vicarius.io/vsociety/vulnerabilities/cve-2024-52726 https://cn-sec.com/archives/tag/crmeb
Related VulnerabilitiesPoCCVE-2024-36837: CRMEB v.5.2.2 - SQL InjectionPoCCVE-2024-36837: CRMEB开源电商系统 /api/products SQL注入漏洞(CVE-2024-36837)CRMEB /adminapi/setting/config/save_basics 文件读取漏洞 (CVE-2024-52726)CRMEB /api/products selectId 存在SQL注入漏洞CRMEB电商系统 /api/products SQL 注入漏洞CRMEB开源商城系统 /api/products 存在SQL注入漏洞(CVE-2024-36837)CRMEB /api/products selectId参数 SQL注入漏洞众邦科技 CRMEB CVE-2024-1704 任意文件写入漏洞众邦科技CRMEB CVE-2024-1703 任意文件读取漏洞CRMEB开源商城系统 /api/admin/payment/callback/wechat XXE漏洞CRMEB开源商城系统 /api/public/wechat/message/webHook XXE漏洞