CVE-2026-79425

CRMEB v6.0.0, an open-source PHP-based e-commerce/mall platform popular in China, contains a Server-Side Request Forgery (CWE-918) flaw in the /adminapi/file/online_upload component. An authenticated user can send a crafted POST request that makes the server fetch a URL of the attacker's choosing, effectively using the storefront as a proxy to probe internal network resources such as intranet hosts, admin panels, or cloud metadata services. Because the endpoint sits under /adminapi, exploitation requires valid admin-panel credentials rather than anonymous access, which limits but does not eliminate risk (compromised or overly broad admin accounts are a common foothold). CVSS 3.1 is 8.1 (high) with high impact on confidentiality and integrity. No public PoC is known and the issue is not in the CISA KEV catalog, so exploitation status is currently none known.

What to do: Check whether you run CRMEB v6.0.0 and watch for a vendor patch, upgrading promptly when one is released since no fixed version is identified in current data. In the meantime, restrict or gate access to /adminapi/file/online_upload (e.g., IP allowlisting, WAF rule blocking requests whose target URL resolves to internal/private IP ranges or cloud metadata endpoints), and enforce least-privilege admin accounts. Also review admin-panel logs for unusual online_upload POST requests and segment the application server so it cannot reach internal services it does not need.