CVE-2020-25466

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.0890%

EPSS Percentile32.57th

PublishedOct 23, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.

Affected Platforms (CPE)

📦

Crmeb

= 3.0

References & Advisories

🔗 http://crmeb.com

🔗 https://github.com/crmeb/CRMEB

🔗 https://github.com/crmeb/CRMEB/issues/22

🔗 http://crmeb.com

🔗 https://github.com/crmeb/CRMEB

🔗 https://github.com/crmeb/CRMEB/issues/22

Related Vulnerabilities

CVE-2020-217879.8

CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.

CVE-2020-213948.8

SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in Syst...

CVE-2020-217884.3

In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app...

CVE-2020-696610.0

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Ver...