Wukong Crm
Monthly
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Stored cross-site scripting in WukongCRM 9.0 allows authenticated attackers to inject arbitrary web scripts via the file upload functionality in AdminSysConfigController.java. An attacker with low privileges can upload a malicious file, which executes in the context of a victim user who views it, potentially leading to session hijacking or defacement. A public exploit is available, but the vendor has not responded.
72crm 9.0 has an Arbitrary file upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 72crm 9.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).
Cross-site request forgery in WuKongOpenSource WukongCRM 9.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability exists in the AdminRoleController.java file and can be triggered remotely with user interaction. A public exploit is available, but no active exploitation has been reported.
Stored cross-site scripting in WukongCRM 9.0 allows authenticated attackers to inject arbitrary web scripts via the file upload functionality in AdminSysConfigController.java. An attacker with low privileges can upload a malicious file, which executes in the context of a victim user who views it, potentially leading to session hijacking or defacement. A public exploit is available, but the vendor has not responded.
72crm 9.0 has an Arbitrary file upload vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in 72crm 9.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.