PT-2025-6729 · Unknown · Perfex Crm

Juylang + 1 · Published 2025-02-13 · Updated 2025-02-14 · CVE-2024-56908

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Perfex Crm versions prior to 3.2.1

Description The issue allows an authenticated attacker to send a crafted HTTP POST request to the "upload sales file" endpoint. By providing malicious input in the rel id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the "upload sales file" endpoint or disabling the ability to upload files through this endpoint until a patch is applied. Avoid using the rel id parameter in the affected endpoint until the issue is resolved.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-1287

CWE-444

Related Identifiers

CVE-2024-56908

Affected Products

Perfex Crm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-56908 · Security Note
• https://gist.github.com/JuyLang/7406077e3e5e6b2ff35c80f1853e298f · Note
• https://t.me/cvedetector/18054 · Telegram Post
• https://twitter.com/CVEnew/status/1890170598674034943 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1890231039563268154 · Twitter Post