CVE-2024-1704: Crmeb Path Traversal Vulnerability

CVE-2024-1704 Overview

CVE-2024-1704 is a path traversal vulnerability in ZhongBangKeJi CRMEB version 5.2.2, an open-source e-commerce platform. The flaw resides in the save and delete functions of the /adminapi/system/crud endpoint. Attackers can manipulate file path parameters to write or delete files outside the intended directory. The vulnerability is tracked as VulDB identifier VDB-254392 and has been publicly disclosed with proof-of-concept material available. According to the disclosure, the vendor was contacted before publication but did not respond.

Critical Impact
Adjacent-network attackers without authentication can overwrite or delete arbitrary files on the CRMEB host, enabling code tampering, application takeover, and denial of service.

Affected Products

ZhongBangKeJi CRMEB 5.2.2
Component: /adminapi/system/crud (save/delete functions)
CPE: cpe:2.3:a:crmeb:crmeb:5.2.2:*:*:*:*:*:*:*

Discovery Timeline

2024-02-21 - CVE-2024-1704 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1704

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]. It affects the save and delete operations exposed by the administrative endpoint /adminapi/system/crud in CRMEB 5.2.2. The application accepts user-controlled file path input and passes it to file system operations without adequate normalization or containment checks.

Because the endpoint handles CRUD scaffolding for administrative modules, exploitation can influence source files, templates, and configuration on disk. Successful exploitation impacts both integrity and availability of the deployed application. Confidentiality impact is not reported in the CVSS profile, since the primary abuse targets file writes and deletions rather than reads.

The exploit has been disclosed publicly through a GitHub proof-of-concept document, and VulDB references provide additional metadata. No vendor advisory or patch has been published at the time of disclosure.

Root Cause

The root cause is missing or insufficient validation of file path parameters supplied to the save and delete handlers in /adminapi/system/crud. The handlers resolve paths that contain traversal sequences such as ../ without restricting the resolved path to a designated base directory. This lets an attacker escape the intended working directory and target arbitrary files.

Attack Vector

The attack requires adjacent-network access to the CRMEB administrative API. No authentication or user interaction is needed based on the reported CVSS profile. An attacker submits a crafted request to the vulnerable endpoint containing a manipulated path parameter. The save variant lets the attacker overwrite arbitrary files with attacker-controlled content, while the delete variant removes arbitrary files from the host. Overwriting application code, cron entries, or startup scripts can lead to remote code execution as the CRMEB process user.

No verified exploit code is republished here. Refer to the GitHub PoC Repository and VulDB #254392 for technical proof-of-concept details.

Detection Methods for CVE-2024-1704

Indicators of Compromise

HTTP requests to /adminapi/system/crud containing traversal sequences such as ../, ..\, or URL-encoded variants (%2e%2e%2f) in path parameters.
Unexpected modifications or deletions of PHP source files, template files, or configuration files under the CRMEB installation directory.
New or altered files outside standard CRMEB write paths, including web-accessible directories that suddenly contain webshells.
Administrative API access originating from adjacent network segments that do not normally administer the CRMEB host.

Detection Strategies

Deploy web application firewall rules that inspect request bodies and query strings to /adminapi/system/crud for path traversal patterns.
Enable file integrity monitoring on the CRMEB application root, particularly PHP source files and template directories.
Correlate web access logs with file system change events to identify writes triggered by traversal payloads.
Alert on delete operations from /adminapi/system/crud that reference paths outside the module scaffolding directory.

Monitoring Recommendations

Forward CRMEB web server access and error logs to a centralized log platform for retention and query.
Track process-level file writes performed by the PHP-FPM or web server user for the CRMEB installation.
Baseline normal administrative API traffic and alert on off-hours or unauthenticated requests to /adminapi/*.
Monitor egress connections from the CRMEB host to detect post-exploitation callbacks after file overwrite.

How to Mitigate CVE-2024-1704

Immediate Actions Required

Restrict network access to /adminapi/* endpoints so they are reachable only from trusted administrative networks.
Place the CRMEB administrative interface behind an authenticated reverse proxy or VPN.
Audit the CRMEB installation directory for unexpected file modifications or deletions since deployment.
Rotate credentials, API tokens, and any secrets stored in files that may have been overwritten.

Patch Information

No vendor patch is referenced in the CVE record. The disclosure notes that the vendor did not respond to contact attempts. Organizations running CRMEB 5.2.2 should treat the software as unpatched and apply compensating controls. Monitor the VulDB entry and the vendor's project repository for future updates and apply fixes as soon as they are released.

Workarounds

Block requests to /adminapi/system/crud at the reverse proxy or WAF layer if the CRUD scaffolding feature is not required in production.
Enforce strict input validation at the proxy tier to reject path parameters containing .., absolute paths, or encoded traversal sequences.
Run the CRMEB web process under a low-privilege user with write access limited to directories that do not contain executable code.
Apply mandatory access control such as SELinux or AppArmor profiles to constrain file writes by the web server process.

bash

# Example nginx configuration to block traversal patterns targeting the vulnerable endpoint
location /adminapi/system/crud {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    allow 10.0.0.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://crmeb_backend;
}