ZhongBangKeJi CRMEB CVE-2026-85040

Exploitation requires a valid CRMEB backend administrator session (PR:H in the CVSS 4.0 vector confirms high-privilege authentication is mandatory). The attacker must have network access to the administrative API endpoint /adminapi/system/crontab/save. The Custom Scheduled Task Feature must not be disabled or restricted at the network perimeter. No special platform, OS, or non-default CRMEB configuration is required beyond admin authentication - any standard CRMEB deployment through version 6.0.0 with the crontab feature accessible is exploitable once credentials are obtained. Exploitation is limited to: actors who possess or can obtain admin credentials, deployments where the /adminapi/ path is reachable (common in internet-exposed installations), and CRMEB versions through 6.0.0.

The most significant risk moderator here is the PR:H requirement: exploitation demands a valid backend administrator session, substantially limiting the attack surface compared to unauthenticated network-reachable vulnerabilities. The CVSS 4.0 score of 5.1 and its VC:L/VI:L/VA:L impact ratings appear notably conservative for what is functionally an OS command injection primitive - arbitrary eval()-based code execution on the server should yield C:H/I:H/A:H rather than low-impact ratings, suggesting the vendor or scorer applied mitigating credit to the blacklist filter. The public GitHub PoC (E:P in the CVSS 4.0 vector) meaningfully elevates risk: any attacker who compromises or purchases admin credentials - through phishing, credential stuffing, or insider access - can immediately pivot to full server compromise without needing exploit development skill. No CISA KEV listing is present and EPSS data was not provided, but the combination of a working public PoC and the vendor's explicit acknowledgment of the behavior means even a mid-sized municipal IT team in mielec operating CRMEB-based e-commerce infrastructure should treat this as a high-priority lateral-movement risk if admin credential hygiene is not verified. The vendor's framing as 'deliberate debug behavior' raises a secondary concern: the feature may not be removed in future releases without explicit customer pressure.

An attacker who has obtained CRMEB backend administrator credentials - whether through phishing, credential reuse, or purchasing access via an initial access broker - navigates to the Custom Scheduled Task configuration panel and submits a crafted customCode payload containing PHP system() or similar OS interaction calls. The application's isSafePhpCode blacklist fails to block the payload, eval() executes it, and the attacker achieves remote code execution as the web server process user, from which further privilege escalation to root is possible depending on server configuration. The public GitHub PoC provides a ready-made payload, requiring no exploit development effort.