CVE-2024-36837 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in CRMEB v5.2.2. 💥 **Consequences**: Remote attackers can steal sensitive data via the `getProductList` function in `ProductController.php`.

🛡️ **Root Cause**: Improper input validation in `ProductController.php`. ⚠️ **Flaw**: The `getProductList` function allows malicious SQL payloads to execute, bypassing security controls.

🎯 **Affected**: Zhongbang CRMEB. 📦 **Version**: Specifically **v5.2.2** and potentially higher versions (e.g., CRMEB-KY v5.2.2+). 🏢 **Vendor**: Zhongbang Network (Xi'an).

🕵️ **Hackers Can**: Extract sensitive information from the database. 🔓 **Privileges**: Remote, unauthenticated access to critical data via the API endpoint.

📉 **Threshold**: **LOW**. 🌐 **Auth**: No authentication required. ⚙️ **Config**: Exploitable via standard HTTP GET requests to the `/api/products` endpoint.

🔥 **Public Exp?**: **YES**. 📂 **PoCs**: Available on GitHub (phtcloud-dev, lhc321-source). 🛠️ **Tools**: Works with `sqlmap` and custom Python scripts.

🔍 **Self-Check**: Scan for `CRMEB` in body or specific CSS icons. 📡 **API Test**: Send crafted SQL payloads to `/api/products?limit=20&priceOrder=&salesOrder=&selectId=`.

🩹 **Official Fix**: Data does not mention an official patch. ⚠️ **Status**: Vulnerability disclosed June 2024; assume **UNPATCHED** until verified.

🛑 **Workaround**: Block external access to `/api/products`. 🚧 **Mitigation**: Implement WAF rules to filter SQL injection patterns in query parameters.

🔴 **Urgency**: **HIGH**. 🚀 **Priority**: Critical due to easy exploitation and data exposure. 🏃 **Action**: Patch immediately or isolate the API endpoint.