Executive brief
A security vulnerability exists in the CRMEB Java e-commerce platform, specifically within the QR code generation component. This flaw allows an unauthorized attacker to force the server to make web requests to internal or external locations of the attacker's choosing. This could lead to the exposure of sensitive internal network information, unauthorized access to internal services like databases, or the disruption of internal operations.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in CRMEB crmeb_java 1.4 within the 'base64 Qrcode Endpoint'. The vulnerability is located in the RestTemplate.getForEntity function in crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java. The application fails to validate the 'url' parameter passed to the POST /api/front/qrcode/base64 endpoint, which is notably excluded from authentication requirements in WebConfig.java. A remote, unauthenticated attacker can provide a malicious URL, causing the server to perform arbitrary GET requests. This can be used to scan internal ports, interact with internal services like Redis or MySQL, or bypass network firewalls. As of the advisory date, no official patch has been released.
Affected products
- crmeb crmeb_java 1.4
Timeline
- 2026-05-16: disclosed: Issue reported on GitHub repository
- 2026-06-03: advisory: CVE published to NVD dataset