CVE-2025-15442
📋 TL;DR
This SQL injection vulnerability in CRMEB allows attackers to manipulate database queries through the cate_id parameter in the product export endpoint. It affects CRMEB installations up to version 5.6.1 and can be exploited remotely without authentication.
💻 Affected Systems
- CRMEB
📦 What is this software?
Crmeb by Crmeb
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, or deletion; potential privilege escalation to administrative access.
Likely Case
Data extraction from the CRMEB database including customer information, product data, and potentially authentication credentials.
If Mitigated
Limited impact with proper input validation and database permissions restricting query execution.
🎯 Exploit Status
Public proof-of-concept available; remote exploitation possible; vendor unresponsive to disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: unknown
Vendor Advisory: none
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version beyond 5.6.1 if available, or apply manual fixes to input validation.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to reject non-numeric cate_id values
Modify /adminapi/export/product_list endpoint to validate cate_id as integer
WAF Rule
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule to detect and block SQL patterns in /adminapi/export/product_list requests
🧯 If You Can't Patch
- Restrict network access to the /adminapi/export/product_list endpoint using firewall rules
- Implement database query logging and monitoring for suspicious SQL patterns
🔍 How to Verify
Check if Vulnerable:
Test the /adminapi/export/product_list endpoint with SQL injection payloads in cate_id parameterCheck Version:
Check CRMEB version in system configuration or admin panelVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and return appropriate error responses📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed export requests with malformed parameters
- Requests to /adminapi/export/product_list with SQL keywords
Network Indicators:
- HTTP POST requests to /adminapi/export/product_list containing SQL injection patterns
- Unusual data export volumes
SIEM Query:
source="web_logs" AND uri="/adminapi/export/product_list" AND (request_parameters CONTAINS "UNION" OR request_parameters CONTAINS "SELECT" OR request_parameters CONTAINS "OR 1=1")