References https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/CRMEB/CRMEB%E5%BC%80%E6%BA%90%E5%95%86%E5%9F%8Ev5.2.2%E5%AD%98%E5%9C%A8sql%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E.md https://blog.csdn.net/jd_cx/article/details/148006222 https://www.secevery.com/toAticleInfo?id=9e7f820f29404a5358ea75ea7e1ce4f8 https://www.crmeb.com/ask/thread/46298 https://cn-sec.com/archives/2869102.html https://www.crmeb.com/ask/thread/66501 https://github.com/chaitin/xray/pull/1843 https://qkl.seebug.org/vuldb/ssvid-99852 https://avd.aliyun.com/product?prod=crmeb https://www.ddpoc.com/DVB-2024-7294.html https://nvd.nist.gov/vuln/detail/CVE-2024-36837 https://cn-sec.com/archives/2863292.html https://avd.aliyun.com/detail?id=AVD-2024-36837
Related VulnerabilitiesWordPress TI WooCommerce Wishlist /wp-json/wc/v3/wishlist/get_products SQL 注入漏洞(CVE-2024-43917)PrestaShop ProductsAlert /module/productsalert/AjaxProcess SQL 注入漏洞(CVE-2024-36683)PoCCVE-2024-13225: ECT Home Page Products - Reflected XSSPoCCVE-2022-1916: WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site ScriptingPoCCVE-2023-30192: PrestaShop 'possearchproducts' <= 1.7 - SQL InjectionPoCCVE-2023-46347: PrestaShop Step by Step products Pack - SQL InjectionPoCCVE-2024-36683: PrestaShop productsalert - SQL InjectionPoCCVE-2024-36837: CRMEB v.5.2.2 - SQL InjectionPoCCVE-2025-1661: HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File InclusionPoCCVE-2024-36837: CRMEB开源电商系统 /api/products SQL注入漏洞(CVE-2024-36837)PoCwordpress-affiliatewp-log: WordPress Plugin "AffiliateWP -- Allowed Products" Log DisclosureCRMEB /adminapi/setting/config/save_basics 文件读取漏洞 (CVE-2024-52726)