CVE-2023-3233

Summary

A vulnerability was found in Zhong Bang CRMEB up to 4.6.0. It has been classified as critical. Affected is the function get_image_base64 of the file api/controller/v1/PublicController.php. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231504. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
Zhong BangCRMEB4.0affected
Zhong BangCRMEB4.1affected
Zhong BangCRMEB4.2affected
Zhong BangCRMEB4.3affected
Zhong BangCRMEB4.4affected
Zhong BangCRMEB4.5affected
Zhong BangCRMEB4.6affected

Weaknesses

  • CWE-918: CWE-918 Server-Side Request Forgery

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References