CVE-2025-11290
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability was identified in CRMEB up to 5.6.1 affecting an unknown function of the JWT HMAC Secret Handler component. Manipulating the secret argument with the default input leads to use of a hard-coded cryptographic key. The attack can be launched remotely but is highly complex and difficult to exploit; the exploit is publicly available.
Risk Assessment
A hard-coded cryptographic key may allow an attacker to forge JWT tokens and bypass authentication. Due to high attack complexity the risk is limited, but the exploit is public.
Recommendation
Replace the default JWT secret with a unique, strong key and consider updating CRMEB. Monitor for unauthorized access attempts.
Other vulnerabilities in CRMEB
See all- CVE-2023-30185Critical
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
- CVE-2020-25466Critical
An SSRF vulnerability in the downloadimage interface of CRMEB 3.0 allows remote attackers to download arbitrary files from the server and execute arbitrary code remotely.
- CVE-2026-111359High
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
- CVE-2026-79425High
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
- CVE-2026-79426High
In CRMEB v6.0.0, there is an arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component. An authenticated attacker can delete arbitrary files via a crafted POST request.
- CVE-2026-85212High
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
- CVE-2026-85177Medium
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
- CVE-2025-15443Medium
A vulnerability was identified in CRMEB up to 5.6.1 in the file /adminapi/product/product_export. Manipulation of the cate_id argument leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available and might be used.
- CVE-2025-15442Medium
A vulnerability was determined in CRMEB up to 5.6.1 in the file /adminapi/export/product_list. Manipulation of the cate_id argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed and may be utilized.
- CVE-2025-11288Medium
A SQL injection vulnerability was discovered in CRMEB up to version 5.6 in the file /adminapi/product/product of the GET Parameter Handler component. Manipulation of the cate_id argument leads to SQL injection. The exploit has been publicly disclosed and can be used remotely.
Original NVD description (English source)
A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS