VulnerabilityDeferred

CVE-2024-56908

In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint.

MEDIUM 6.8EPSS 0.63%

Does this matter?

Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own.

Description

In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise.

CVSS 3.1: 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.63% probability · 48th percentile
CISA KEV: Not listed
Weakness: CWE-444, CWE-1287
Source: cve@mitre.org

References

https://gist.github.com/JuyLang/7406077e3e5e6b2ff35c80f1853e298f

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.