CVE-2024-36837: Crmeb CRMEB SQLi Vulnerability

CVE-2024-36837 Overview

CVE-2024-36837 is a SQL Injection vulnerability [CWE-89] affecting CRMEB v5.2.2, an open-source e-commerce platform. The flaw resides in the getProductList function within the ProductController.php file. Remote attackers can exploit this vulnerability without authentication to inject arbitrary SQL statements and extract sensitive information from the backend database. The vulnerability is network-exploitable with low attack complexity and requires no user interaction. A proof-of-concept is publicly available on GitHub, increasing the likelihood of opportunistic exploitation against exposed CRMEB deployments.

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents from CRMEB v5.2.2 through the getProductList endpoint without any user interaction.

Affected Products

CRMEB v5.2.2
ProductController.php — getProductList function
Deployments exposing the vulnerable product listing endpoint to untrusted networks

Discovery Timeline

2024-06-05 - CVE-2024-36837 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36837

Vulnerability Analysis

The vulnerability exists in the getProductList function of ProductController.php in CRMEB v5.2.2. The function accepts user-supplied input and concatenates it into a SQL query without adequate sanitization or parameterization. An attacker can supply crafted request parameters that break out of the intended query context and inject arbitrary SQL syntax.

Successful exploitation allows an attacker to read arbitrary database records, including customer records, order data, administrator credentials, and configuration values. The confidentiality impact is high; integrity and availability are not directly affected according to the CVSS vector. Because CRMEB is deployed as a customer-facing e-commerce backend, the exposed data typically includes personally identifiable information (PII) and payment-related metadata.

A public proof-of-concept exists in the phtcloud-dev GitHub repository, which lowers the barrier for exploitation. The EPSS score of 8.306% (94th percentile) reflects elevated real-world exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The getProductList handler builds a query string using unsanitized request parameters and passes it directly to the database driver. Neither prepared statements nor parameter binding are applied to the affected input, allowing injected SQL fragments to alter query logic.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the CRMEB endpoint backed by getProductList. The malicious payload embeds SQL syntax within a parameter consumed by the function. The backend executes the modified query and returns database contents either directly in the response or through blind, boolean-based, or time-based inference techniques.

Refer to the public proof-of-concept for the specific request structure and injected payload demonstrated by the researcher.

Detection Methods for CVE-2024-36837

Indicators of Compromise

HTTP requests to CRMEB product listing endpoints containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or BENCHMARK(.
Anomalous database query volume or slow queries originating from the CRMEB application user.
Web server access logs showing repeated requests to the getProductList route with varying query parameters, consistent with automated extraction.
Outbound data transfers from the CRMEB host to unfamiliar destinations following suspicious request patterns.

Detection Strategies

Deploy web application firewall (WAF) rules that identify SQL injection signatures targeting the CRMEB product listing endpoints.
Enable database query logging and alert on queries referencing sensitive tables (users, orders, admins) originating from product listing code paths.
Correlate application logs with database logs to identify malformed or unexpected query structures.

Monitoring Recommendations

Monitor the CRMEB host for unusual process behavior, file writes to web-accessible directories, and outbound connections.
Baseline normal request patterns to the getProductList endpoint and alert on statistical deviations in payload length or character composition.
Ingest web, application, and database logs into a centralized analytics platform for cross-source correlation and retention.

How to Mitigate CVE-2024-36837

Immediate Actions Required

Restrict network exposure of the CRMEB v5.2.2 administrative and product listing endpoints to trusted networks or via VPN.
Deploy WAF rules to block SQL injection payloads targeting the getProductList parameter set.
Audit database accounts used by CRMEB and enforce least privilege, removing unnecessary read access to sensitive tables.
Rotate credentials and API keys stored in the CRMEB database if exploitation is suspected.

Patch Information

No vendor advisory or official patch is referenced in the NVD entry at the time of publication. Operators of CRMEB v5.2.2 should monitor the CRMEB project repository for updated releases and apply any security fixes to ProductController.php as soon as they are published. Until a patched version is available, apply the workarounds below and consider migrating to a newer release if one addresses this issue.

Workarounds

Introduce server-side input validation on all parameters consumed by getProductList, rejecting non-numeric or unexpected characters before query construction.
Refactor the affected function to use parameterized queries or prepared statements instead of string concatenation.
Place the CRMEB application behind an authenticated reverse proxy to limit anonymous access to catalog endpoints where feasible.
Enable database-level query allowlisting or stored procedures to constrain the shape of queries the web tier can execute.

bash

# Example ModSecurity rule to block common SQLi payloads against the vulnerable endpoint
SecRule REQUEST_URI "@contains /ProductController" \
  "id:1003683,phase:2,deny,status:403,\
   msg:'Potential SQLi against CRMEB getProductList (CVE-2024-36837)',\
   chain"
  SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|benchmark\s*\(|--|\bor\b\s+1=1)" \
    "t:none,t:urlDecodeUni"