CVE-2024-46088
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System versions 2002 to 2024 allows attackers to execute arbitrary code by uploading a crafted file.
Risk Assessment
The risk for the organization includes full compromise of the CRM system, customer data theft, and potential use of the server for further attacks within the internal network.
Recommendation
It is recommended to immediately update the system to the latest available version and implement validation mechanisms for file types and content.
Original NVD description (English source)
An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management System v2002 to v2024 allows attackers to execute arbitrary code via uploading a crafted file.