CVE-2025-15443
📋 TL;DR
This SQL injection vulnerability in CRMEB allows attackers to manipulate database queries through the cate_id parameter in the product export endpoint. It affects CRMEB installations up to version 5.6.1 and can be exploited remotely without authentication. Organizations using vulnerable CRMEB versions are at risk of data theft or manipulation.
💻 Affected Systems
- CRMEB
📦 What is this software?
Crmeb by Crmeb
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or potential remote code execution through database functions.
Likely Case
Unauthorized data extraction from the database, potentially exposing sensitive customer information, product data, or administrative credentials.
If Mitigated
Limited impact with proper input validation and database permission restrictions, potentially only allowing data viewing from accessible tables.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Remote exploitation possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider upgrading to latest version if available or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize cate_id parameter before processing
Modify /adminapi/product/product_export endpoint to validate cate_id as integer only
WAF Rule
allImplement web application firewall rules to block SQL injection patterns
Add WAF rule: Detect and block SQL patterns in cate_id parameter
🧯 If You Can't Patch
- Restrict access to /adminapi/product/product_export endpoint using network ACLs or authentication
- Implement database user with minimal permissions (read-only for necessary tables)
🔍 How to Verify
Check if Vulnerable:
Test the /adminapi/product/product_export endpoint with SQL injection payloads in cate_id parameterCheck Version:
Check CRMEB version in system configuration or admin panelVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return error or sanitized response📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to /adminapi/product/product_export with unusual parameters
Network Indicators:
- HTTP requests to vulnerable endpoint with SQL patterns in parameters
SIEM Query:
source="web_logs" AND uri="/adminapi/product/product_export" AND (param="cate_id" AND value MATCH "(?i)(union|select|insert|update|delete|drop|--|#|;)")