Sql injection

A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. T...

CVE-2023-1608

CVE-2023-1608 affects Zhong Bang CRMEB Java up to version 1.3.4. The vulnerability lies in the getAdminList function of /api/admin/store/product/list, where improper handling of the cateId parameter enables SQL injection. This can be exploited remotely; the exploit has been disclosed publicly per...

CVE-2023-1609: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to...

CVE-2023-1608: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. The attack can be initiated remotely. T...

CVE-2023-1165: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zhong Bang CRMEB Java 1.3.4. It has been classified as critical. This affects an unknown part of the file /api/admin/system/store/order/list. The manipulation of the argument keywords leads to sql injection. The exploit has been disclosed to the public and may be used...