RULE(RULE ID:338649)

Rule General Information
Release Date: 2025-01-14
Rule Name: 51mis CRM uploadfile API Arbitrary File Upload Vulnerability
Severity:
CVE ID:
Rule Protection Details
Description: 51mis CRM is an intelligent customer relationship management tool designed for smes. Widely used in finance, education, medical care, IT services, real estate and other industries, to help enterprises achieve customer personalized management needs, enhance enterprise competitiveness. The CRM uploadfile.php interface has any file upload vulnerability, which allows an unauthenticated attacker to arbitrarily execute code on the server side, write a backdoor, obtain server permissions, and then control the entire web server.
Impact: Attackers can upload viruses, Trojans, WebShell, other malicious scripts or pictures containing scripts to the server, and attackers can use these files for subsequent attacks.
Affected OS: Windows, Linux, Others
Reference:
Solutions
Please contact the software vendor to update the software patch.