PT-2024-22534 · Unknown · Crmeb Java

Jiangxiaobaijia · Published 2024-03-28 · Updated 2025-06-10 · CVE-2024-28714

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CRMEB Java e-commerce system version 1.3.4

Description The issue allows an attacker to execute arbitrary code via the groupid parameter, potentially leading to unauthorized access and data manipulation.

Recommendations For CRMEB Java e-commerce system version 1.3.4, consider restricting access to the groupid parameter to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-28714

Affected Products

Crmeb Java

References · 11

• 🔥 https://github.com/JiangXiaoBaiJia/cve2/blob/main/a.png · Exploit
• 🔥 https://github.com/JiangXiaoBaiJia/cve2/blob/main/1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28714 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28714 · Vendor Advisory
• https://gitee.com/ZhongBangKeJi/crmeb_java · Note
• https://twitter.com/VulmonFeeds/status/1773509478886916349 · Twitter Post
• https://t.me/cvenotify/125183 · Telegram Post
• https://t.me/cvenotify/75064 · Telegram Post
• https://vicarius.io/vsociety/posts/ssti-in-mblog-351-a-tale-of-a-glorified-rce-cve-2024-28713-28714 · Note
• https://twitter.com/CVEnew/status/1773489115109241221 · Twitter Post
• http://crmebjava.com · Note