CVE-2025-15442: CRMEB product_list sql injection
A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/productlist. This manipulation of the argument cateid causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15442?
CVE-2025-15442 is classified as a critical vulnerability due to its potential for remote SQL injection.
How do I fix CVE-2025-15442?
To fix CVE-2025-15442, upgrade your CRMEB installation to version 5.6.2 or later, which addresses the vulnerability.
What systems are affected by CVE-2025-15442?
CVE-2025-15442 affects all versions of CRMEB up to and including 5.6.1.
Can CVE-2025-15442 be exploited remotely?
Yes, CVE-2025-15442 can be exploited remotely due to its nature of SQL injection in the export functionality.
What is the impact of CVE-2025-15442?
The impact of CVE-2025-15442 includes potential data leakage and unauthorized access to the database via SQL injection.