CVE-2023-3233
MediumCVSS 6.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A critical vulnerability was found in Zhong Bang CRMEB up to version 4.6.0, affecting the get_image_base64 function in the api/controller/v1/PublicController.php file. Manipulation of this function leads to server-side request forgery.
Risk Assessment
The vulnerability allows for remote exploitation, potentially leading to unauthorized access to server resources. The public disclosure of the exploit increases the risk of this vulnerability being exploited.
Recommendation
It is recommended to update to the latest version of Zhong Bang CRMEB to mitigate this vulnerability. Additionally, monitoring systems for unauthorized activities is advised.
Original NVD description (English source)
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.