PT-2026-27304 · Defaultfuction · Jeson Customer Relationship Management System

Practice · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-4623

Positive Technologies · (AI Summary)

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DefaultFuction Jeson-Customer-Relationship-Management-System (affected versions not specified)

Description A security issue has been identified in the API Module component of DefaultFuction Jeson-Customer-Relationship-Management-System. Manipulation of the url argument in an unknown function within the /api/System.php file can lead to server-side request forgery (SSRF). The attack can be initiated remotely. The exploit has been publicly disclosed. Continuous delivery with rolling releases is used, therefore specific version details of affected or updated releases are unavailable.

Recommendations Install a patch to address this issue.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4623

Affected Products

Jeson Customer Relationship Management System

References · 10

• 🔥 https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issue-4045330588 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4623 · Security Note
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/commit/f76e7123fe093b8675f88ec8f71725b0dd186310 · Patch
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System · Note
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2#issuecomment-4023480586 · Note
• https://vuldb.com/?submit.775760 · Note
• https://github.com/DefaultFuction/Jeson-Customer-Relationship-Management-System/issues/2 · Note
• https://vuldb.com/?id.352482 · Note
• https://vuldb.com/?ctiid.352482 · Note
• https://twitter.com/RedPacketSec/status/2036319789841342948 · Twitter Post