CVE-2023-3234
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A vulnerability was found in Zhong Bang CRMEB up to version 4.6.0, affecting the put_image function in the file api/controller/v1/PublicController.php. The manipulation leads to deserialization, allowing for remote attacks.
Risk Assessment
This vulnerability can be exploited by attackers to remotely execute unauthorized code, posing a serious security threat to the system.
Recommendation
It is recommended to update to the latest version of Zhong Bang CRMEB to mitigate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been declared as problematic. Affected by this vulnerability is the function put_image of the file api/controller/v1/PublicController.php. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231505 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.