CVE-2024-56908
Published Feb 13, 2025
Last updated 14 days ago
- Description
- In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise.
- Source
- cve@mitre.org
- NVD status
- Received
- Hype score
- Not currently trending