CVE-2026-85040

Executive Summary

CVE-2026-85040 is an unauthenticated-by-design OS command injection vulnerability in the admin panel of ZhongBangKeJi CRMEB, an open-source e-commerce platform, affecting versions up to and including 6.0.0. The flaw resides in the custom scheduled task feature's save function, which passes a maliciously crafted customCode parameter to PHP's eval() without effective containment despite a nominally present blacklist (isSafePhpCode). A remote attacker with administrative privileges (CVSS 3.1: 4.7, High-privilege required) can execute arbitrary operating system commands on the underlying server, potentially leading to full server compromise, data exfiltration, and lateral movement. The vulnerability is publicly documented as "deliberate debug-only behavior" by the vendor; however, no patch has been released, and the blacklist does not provide reliable protection, leaving all CRMEB installations up to 6.0.0 exposed.

Technical Analysis

Vulnerability Mechanism: CRMEB includes a custom scheduled task management interface. The endpoint /adminapi/system/crontab/save handles the persistence of user-defined cron jobs. When saving a task, the application passes the user-controlled customCode argument directly into a PHP eval() construct — a known dangerous function that interprets its string argument as PHP code and executes it. Although the application possesses an isSafePhpCode blacklist filter intended to block dangerous functions and constructs, analysis of the NVD description indicates this filter is ineffective: it fails to provide real Remote Code Execution (RCE) containment, meaning an attacker can craft PHP payloads that bypass or sidestep the blacklist rules.

Attack Surface: The endpoint is part of the administrative API (/adminapi/), requiring an authenticated administrator session. However, combined with the fact that CRMEB is widely deployed as a customer-facing e-commerce platform, the primary exposure vector is the publicly reachable admin panel. If administrative credentials are weak, default, or obtained via phishing/credential stuffing, this vulnerability becomes remotely exploitable. Importantly, no user-level access is required — the CRMEB admin role has implicit access to this feature without needing custom privilege grants.

Code-Level Perspective (from description data): The vulnerable code path involves:

• File: /adminapi/system/crontab/save
• Function: eval
• Argument: customCode
• Associated filter: isSafePhpCode blacklist (present but ineffective).

Because PHP's eval() treats its input as executable code, even small argument fragments can be chained to achieve OS command execution (e.g., using system(), shell_exec(), passthru(), or backtick operators in the PHP code being evaluated). The blacklist likely matches simple strings like system or exec, but an attacker can use PHP's dynamic function calls, concatenation, or namespace tricks to evade static blacklist matching.

Patched/Deliberate Design Note: Vendor documentation reportedly labels this as "deliberate debug-only behavior." This is a significant finding: it suggests the scheduler's code-evaluation capability is intentionally present, presumably for advanced developers/testers. However, shipping a debug-only code-execution channel in a production version without effective access control or strong filtering violates security best practices. The vendor has not acknowledged this as a vulnerability requiring a fix, hence the unpatched status.

Exploitation Scenarios

No public PoC is available; attack chain described below is inferred from the vulnerability class and exposed parameters.

Step 1 — Reconnaissance and Target Identification:

• Attackers scan for internet-exposed CRMEB admin panels using Shodan or mass scanning tools. Identifiable fingerprints include: HTTP titles containing "CRMEB", admin login page paths (e.g., /admin or /adminapi), and JavaScript/CSS assets referencing CRMEB versions.
• Once identified, attackers probe for version information (often in the page source or a /api/version endpoint) to confirm the system is ≤ 6.0.0.
• Because exploitation requires an administrator session, the attacker must first obtain valid admin credentials. Common techniques: default credential guessing (admin/admin123), credential stuffing against known leaked credential lists, or spear-phishing the site operator.

Step 2 — Flaw Trigger:

• Authenticated as an admin, the attacker navigates to the scheduled tasks management UI or directly crafts an HTTP request to POST /adminapi/system/crontab/save.
• The request body includes a customCode field. Despite a valid session, the application checks only the blacklist (isSafePhpCode) before passing the value to eval().

Step 3 — Payload Delivery/Execution:

• The attacker submits customCode containing PHP code engineered to evade the blacklist — e.g.:
  • Using a variable function name: $f='sys'.'tem'; $f('id');
  • Using hex/octal encoding: "\x73\x79\x73\x74\x65\x6d"('id');
  • Using backticks: `id`
  • Using assert() or create_function() as alternative execution vectors if eval is patched but the scheduler logic remains unsafe.
• The application calls eval($customCode), the PHP interpreter parses the string, and the OS command runs with the privileges of the web server user (typically www-data or a similar unprivileged or semi-privileged account).

Step 4 — Post-Exploitation Impact:

• Immediate: command output returned within the HTTP response (reflected) or written to a file accessible later.
• The attacker can download the CRMEB .env file to steal database credentials, application keys, and third-party API secrets (e.g., Alipay/PayPal credentials, SMS gateways).
• Using database credentials, the attacker can dump the full customer database (PII, order history, hashed passwords).
• Depending on the server's network segmentation, the compromised host can be used as a pivot to other internal systems. Web shells may be placed for persistent access if the upload directory is writable.

Impact Assessment

Business Impact: CRMEB is used by small-to-medium e-commerce businesses. A successful exploit exposes customer PII (name, address, phone, email), order history, and payment metadata. It also allows an attacker to deface the storefront, inject malicious JavaScript (credit card skimming), or disable the platform — all of which erode customer trust and may cause regulatory consequences under GDPR/CCPA/ PDPA. The requirement for admin privileges lowers the severity score, but in practice, many CRMEB installations use weak admin passwords or share admin credentials across staff, meaning the real-world likelihood is higher than the score suggests.

Blast Radius: The vulnerability affects the application's host operating system and everything the web user can access. Since CRMEB's PHP process typically connects to a local MySQL database, compromise of the PHP process is functionally equivalent to full database access. If the server runs other co-located applications (shared hosting scenario), those applications are also at risk.

Known Exploitation: No known exploit-in-the-wild, PoC, or threat actor campaign has been publicly reported. The CVE was disclosed with the statement that the "exploit has been made available to the public," but no functional PoC has been published in mainstream CVE databases or exploit repositories as of this report's writing.

Detection Guidance

Detection is challenging because admin API traffic is encrypted (TLS) and the payload is embedded in PHP code, not a directly sent OS command. Detection should focus on: anomalous POST requests to the specific endpoint, unusual PHP code patterns, and post-exploitation command execution behavior.

Sigma Rule

title: CVE-2026-85040 - CRMEB Custom Scheduled Task Code Injection Attempt
id: 6e9a4b2c-1f9d-4b3b-9c3e-9f0c1a2b3d4e
status: experimental
description: Detects suspicious requests to CRMEB /adminapi/system/crontab/save endpoint containing PHP code markers and command execution patterns in the customCode parameter.
author: Valtersit Threat Intel
logsource:
  category: webserver
  product: apache
  definition: Detection applies to reverse proxy or web server access logs and WAF logs.
detection:
  selection_path:
    cs-uri-query|contains:
      - '/adminapi/system/crontab/save'
  selection_body_keywords:  # requires WAF or full body logging (e.g., mod_security)
    - 'eval'
    - 'system'
    - 'shell_exec'
    - 'passthru'
    - '`'
    - 'base64_decode'
    - '\x73\x79\x73\x74\x65'
  condition: selection_path and selection_body_keywords
falsepositives:
  - Legitimate admin use of custom PHP cron tasks (debug mode)
  - Scheduled task testing by developers on staging servers
level: high
tags:
  - attack.t1059
  - cve.2026-85040