| Titre | crmeb v5.6.1 SQL Injection |
|---|
| Description | CRMEB versions prior to v5.6.1 are affected by a SQL injection vulnerability located in the /adminapi/product/product_export endpoint. This flaw allows authenticated attackers with backend access to execute arbitrary SQL queries by manipulating input parameters, potentially leading to data leakage, privilege escalation, or full database compromise.
|
|---|
| La source | ⚠️ https://github.com/En0t5/vul/blob/main/crmeb/crmeb-product-productExport-SQL.md |
|---|
| Utilisateur | Tophant (UID 80370) |
|---|
| Soumission | 23/12/2025 11:30 (il y a 10 mois) |
|---|
| Modérer | 03/01/2026 19:42 (11 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 339465 [CRMEB jusqu’à 5.6.1 product_export cate_id injection SQL] |
|---|
| Points | 19 |
|---|