CVE-2024-23052
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A vulnerability in WukongCRM version 72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.
Risk Assessment
An attacker can take over the CRM server, leading to customer data theft, database modification, or full system compromise.
Recommendation
Immediately update WukongCRM to the latest version and apply the security patch for the fastjson component.
Other vulnerabilities in fastjson
See all- CVE-2026-16723Critical
A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.
- CVE-2025-70974Critical
Vulnerability in Fastjson before version 1.2.48 allows an attacker to perform JNDI injection by manipulating the @type key in a JSON document. The attacker can invoke public methods of a specified Java class, leading to remote code execution. This flaw was actively exploited in the wild from 2023 to 2025.
Original NVD description (English source)
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson component.