CVE-2024-28714
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
Risk Assessment
An attacker can gain unauthorized access to the database, steal sensitive customer data, or take control of the system.
Recommendation
Immediately update CRMEB_Java to the latest version and implement parameterized SQL queries for the groupid parameter.
Other vulnerabilities in CRMEB_Java
See all- CVE-2026-111354Low
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{orderId} to view victims' tracking numbers, logistics traces, payment amounts and product lines.
- CVE-2026-10771High
Server-Side Request Forgery (SSRF) vulnerability in the RestTemplate.getForEntity function in RestTemplateUtil.java in crmeb_java 1.4. An attacker can remotely manipulate the URL argument in the base64 Qrcode endpoint, leading to unauthorized server requests.
Original NVD description (English source)
SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS