CVE-2025-11288: CRMEB GET Parameter product sql injection
A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET Parameter Handler. Performing a manipulation of the argument cateid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11288?
CVE-2025-11288 is classified as a high severity vulnerability due to its potential for remote exploitation through SQL injection.
How do I fix CVE-2025-11288?
To fix CVE-2025-11288, update the CRMEB software to version 5.7 or later to mitigate the SQL injection risk.
Which versions of CRMEB are affected by CVE-2025-11288?
CVE-2025-11288 affects CRMEB versions up to and including 5.6.
What type of vulnerability is CVE-2025-11288?
CVE-2025-11288 is an SQL injection vulnerability related to the GET Parameter Handler in the CRMEB software.
Can CVE-2025-11288 be exploited remotely?
Yes, CVE-2025-11288 can be exploited remotely if the attacker manipulates the cate_id argument.