CRMEB CVE-2025-11288

Authentication is required - the CVSS vector specifies PR:L, meaning a valid CRMEB user account with low privilege level (such as standard administrative or staff account) must be established before exploitation. The vulnerable endpoint /adminapi/product/product must be accessible from the attacker's network perspective (AV:N is satisfied by default network access). No special configuration is needed beyond standard CRMEB deployment; the vulnerability exists in the default code path. The GET parameter cate_id must be present and processed by the endpoint's request handler. Attack complexity is low (AC:L), meaning no additional techniques beyond standard SQL injection syntax are required.

This vulnerability presents moderate real-world concern despite its low CVSS 4.0 score of 2.1. The CVSS vector shows attack vector is network-based with low complexity and no user interaction required, but crucially requires PR:L (low privilege authentication). EPSS score of 0.03% (8th percentile) indicates extremely low probability of exploitation in the wild, suggesting this is a niche target vulnerability unlikely to be exploited at scale. However, the presence of publicly available exploit code (E:P) means weaponization is feasible for attackers with valid credentials. The limited technical impact scope (VC:L/VI:L/VA:L with SC:N/SI:N/SA:N) indicates the vulnerability does not propagate to adjacent systems and confidentiality/integrity/availability impact is confined to low severity. For organizations running CRMEB, the primary risk vector is compromised or low-privileged internal accounts executing SQL injection to extract or manipulate product data. The mismatch between publicly available POC and minimal EPSS suggests this is a documented but not actively exploited vulnerability in the wild.

An authenticated administrative or low-privileged user with access to the CRMEB platform discovers or obtains the publicly available exploit code targeting the cate_id parameter. They craft a malicious GET request to /adminapi/product/product with SQL injection payloads embedded in the cate_id parameter, such as cate_id=1' UNION SELECT * FROM users-- . The injection is processed without sanitization and returns sensitive database information (usernames, password hashes, email addresses) or modifies product pricing and inventory data, compromising data integrity.