Description

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Vendor documents this as deliberate debug-only behavior. But isSafePhpCode blacklist offers no real RCE containment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-03T13:06:19.960Z",
  "pubdate": "2026-09-03T13:06:19.960Z",
  "executiveSummary": "A critical OS command injection vulnerability has been identified in ZhongBangKeJi CRMEB versions up to 6.0.0. The vulnerability resides within the Custom Scheduled Task Feature, specifically in the /adminapi/system/crontab/save endpoint.\nThe flaw stems from the insecure usage of the eval() function on user-supplied input provided via the customCode parameter. Despite vendor claims that this functionality is intended for debug purposes, it introduces a severe security risk.\nSuccessful exploitation allows an unauthenticated or authenticated attacker to execute arbitrary OS commands on the underlying server with the privileges of the web application process.\nThe vulnerability is currently known to the public, and exploit code exists, increasing the risk of active exploitation. The existing isSafePhpCode blacklist mechanism is insufficient to prevent RCE, as it can be bypassed to execute malicious payloads. Immediate remediation is required to prevent full system compromise, unauthorized data access, and potential persistence mechanisms established by attackers.",
  "technicalDetails": "The vulnerability exists in the /adminapi/system/crontab/save file within the CRMEB application, which processes custom scheduled tasks. The core issue is the direct and unsanitized passage of the customCode argument into the PHP eval() function.\nThe function eval() evaluates a string as PHP code. When user-controlled data is passed to this function without adequate validation or sandboxing, the application context allows for the execution of arbitrary commands. Although the developers implemented a blacklist-based validation method called isSafePhpCode, this approach is fundamentally flawed as it fails to account for diverse PHP syntax variations, obfuscation techniques, and standard library functions that can be utilized to achieve system-level code execution.\nThe attack flow begins when an attacker sends a malicious HTTP request to the /adminapi/system/crontab/save endpoint. The attacker injects the payload into the customCode parameter. Upon processing this request, the application passes the attacker-supplied string to the vulnerable eval() function within the backend logic. Because the application processes this input as native PHP code, the attacker can leverage functions such as system(), exec(), shell_exec(), or passthru() to execute OS-level commands.\nThe vulnerability is accessible remotely and does not require complex preconditions, making it a high-severity target. Because the application executes the injected code with the permissions of the web server user (e.g., www-data), an attacker can gain full control over the web directory, read sensitive configuration files (including database credentials), or move laterally within the network infrastructure.\nPost-exploitation impact includes the potential for complete server takeover, the deployment of web shells for persistent access, and the exfiltration of sensitive user data from the associated database. The reliance on a blacklist is insufficient for preventing command injection in an eval context, as attackers can bypass filters using string concatenation, encoding, or reflection-based execution, rendering the implemented security controls ineffective."
}