Executive brief
CRMEB is an open-source e-commerce platform written in PHP. An authenticated administrator can exploit a server-side request forgery vulnerability in the file upload component to make the server perform HTTP requests to internal or external destinations. This could enable network reconnaissance, internal service scanning, or access to sensitive internal resources depending on network configuration.
Technical details
CRMEB v6.0.0 contains a server-side request forgery (SSRF) vulnerability in the /adminapi/file/online_upload endpoint. The online_upload method accepts an array of image URLs from an authenticated administrator and passes them directly to CopyTaobaoServices::downloadImage() without validating that the destinations are approved hosts. The vulnerable code uses cURL or PHP URL reading functions to fetch the supplied URLs without blocking loopback, private, or metadata service ranges. An attacker with administrator privileges and file-management permissions can craft a malicious POST request containing attacker-controlled URLs to scan internal services, probe private networks, or extract data from internal endpoints. The vulnerability requires prior authentication and administrative privilege but allows arbitrary HTTP requests from the server's network position.
Affected products
- CRMEB CRMEB 6.0.0
Timeline
- 2026-09-15: disclosed