CVE-2026-85040: medium-severity vulnerability in ZhongBangKeJi CRMEB
ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.1epss 2.1%
A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Vendor documents this as deliberate debug-only behavior. But isSafePhpCode blacklist offers no real RCE containment.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
ZhongBangKeJi · CRMEBpublic PoCs found — 1
cve_referencegithub.com/xiaohai12138-1/cve/blob/main/CRMEB/CRMEB%20Backend%20custom%20%20scheduled%20task%20functionality%20%20RCE.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ZhongBangKeJi CRMEB
In the same product, most dangerous first.
CVE-2024-6944MEDIUMZhongBangKeJi CRMEB PublicController.php get_image_base64 deserializationEPSS 3.8%CVE-2024-1703LOWZhongBangKeJi CRMEB openfile absolute path traversalEPSS 0.7%CVE-2024-1704MEDIUMZhongBangKeJi CRMEB crud delete path traversalEPSS 0.6%CVE-2024-6943MEDIUMZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserializationEPSS 0.6%