CVE-2023-3234
Zhong Bang CRMEB PublicController.php put_image deserialization
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. In Zhong Bang CRMEB bis 4.6.0 wurde eine problematische Schwachstelle ausgemacht. Es geht um die Funktion put_image der Datei api/controller/v1/PublicController.php. Durch Beeinflussen mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
- Affected
- Zhong Bang · CRMEB
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 VULDB
- 4.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0 VULDB
- 4.0 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N - EPSS
- 1.17% chance of exploitation in the next 30 days, 67th percentile
- Published
- 2023-06-14
- Updated
- 2024-08-02