CVE-2025-15443: CRMEB product_export sql injection
A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/productexport. Such manipulation of the argument cateid leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15443?
CVE-2025-15443 has a high severity level due to its potential to allow SQL injection attacks.
How do I fix CVE-2025-15443?
To fix CVE-2025-15443, update CRMEB to a version higher than 5.6.1 and validate your input parameters.
What software is affected by CVE-2025-15443?
CVE-2025-15443 affects CRMEB versions up to and including 5.6.1.
Can CVE-2025-15443 be exploited remotely?
Yes, CVE-2025-15443 can be exploited remotely through manipulated requests to the vulnerable endpoint.
What type of attack does CVE-2025-15443 facilitate?
CVE-2025-15443 facilitates SQL injection attacks, allowing attackers to manipulate database queries.