CVE-2025-15442
SQL Injection in CRMEB /adminapi/export/product_list Allows Remote Exploit
Publication date: 2026-01-04
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| unknown_vendor | crmeb | to 5.6.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include considering replacing the affected CRMEB product or implementing alternative protective measures, as no patches or countermeasures have been provided by the vendor. Additionally, restricting access to the vulnerable endpoint, applying web application firewalls (WAF) to filter malicious input, and monitoring for exploitation attempts are recommended. [1]
Can you explain this vulnerability to me?
CVE-2025-15442 is a SQL injection vulnerability in CRMEB versions up to 5.6.1, specifically in the /adminapi/export/product_list endpoint. It occurs due to improper handling of the cate_id parameter, allowing an attacker to inject malicious SQL code. This flaw can be exploited remotely by authenticated users with backend access, leading to unauthorized database queries. The vulnerability compromises the confidentiality, integrity, and availability of the system and is classified under CWE-89. [1, 2]
How can this vulnerability impact me? :
This vulnerability can lead to severe impacts including data leakage, privilege escalation, and complete compromise of the database. Attackers can execute arbitrary SQL queries, potentially accessing sensitive information, modifying data, or disrupting system availability. Since the exploit is publicly available and the vendor has not provided patches, affected systems remain at risk. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the /adminapi/export/product_list endpoint for SQL injection via the cate_id parameter. Since the exploit requires authentication, you should authenticate first and then attempt to inject SQL payloads into the cate_id parameter to observe if the system is vulnerable. Specific commands are not provided in the resources, but typical detection involves using tools like curl or sqlmap targeting the endpoint with crafted payloads to test for SQL injection. [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows SQL injection that can compromise confidentiality, integrity, and availability of data, potentially leading to data leakage or unauthorized access. Such impacts can affect compliance with standards like GDPR and HIPAA, which require protection of personal and sensitive data. However, no explicit information on compliance impact is provided in the resources. [1, 2]