CVE-2026-111359
HighCVSS 7.1Summary
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Risk Assessment
An attacker can hijack paid orders of other customers by redirecting goods to their own address, leading to financial losses and exposure of buyers' personal data. The risk includes mass harvesting of identities and gift keys.
Recommendation
Update CRMEB to a version newer than 6.0.0 if available, or implement access control verifying order ownership. Prevent order ID enumeration and secure the receive_gift endpoint.
Other vulnerabilities in CRMEB
See all- CVE-2023-30185Critical
CRMEB versions 4.4 to 4.6 were found to have an arbitrary file upload vulnerability. The flaw resides in the \attachment\SystemAttachmentServices.php component.
- CVE-2020-25466Critical
An SSRF vulnerability in the downloadimage interface of CRMEB 3.0 allows remote attackers to download arbitrary files from the server and execute arbitrary code remotely.
- CVE-2026-79425High
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.
- CVE-2026-79426High
In CRMEB v6.0.0, there is an arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component. An authenticated attacker can delete arbitrary files via a crafted POST request.
- CVE-2026-85212High
CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests.
- CVE-2026-85177Medium
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and uid to delete, mark read, or reassign victim notifications without authorization.
- CVE-2025-15443Medium
A vulnerability was identified in CRMEB up to 5.6.1 in the file /adminapi/product/product_export. Manipulation of the cate_id argument leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available and might be used.
- CVE-2025-15442Medium
A vulnerability was determined in CRMEB up to 5.6.1 in the file /adminapi/export/product_list. Manipulation of the cate_id argument causes SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed and may be utilized.
Original NVD description (English source)
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS