CRMEB v.5.2.2 - SQL Injection

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file. id: CVE-2024-36837 info: name: CRMEB v.5.2.2 - SQL Injection author: DhiyaneshDk severity: high description: | SQL Injection...

CVE-2024-36837

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file...

CVE-2024-36837

SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file...

CVE-2024-36837

CRMEB v5.2.2 is affected by a SQL Injection in the getProductList function of ProductController.php. The issue arises from unvalidated input in the selectId/parameters, enabling an attacker to craft queries that may reveal sensitive data. Public templates and PoCs exist (e.g., CRMEB 5.2.2 SQL Inj...