CVE-2026-4623 | THREATINT

Description

A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This affects an unknown function of the file /api/System.php of the component API Module. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. It is suggested to install a patch to address this issue.

PUBLISHED Reserved 2026-03-23 | Published 2026-03-24 | Updated 2026-03-24 | Assigner VulDB

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

HIGH: 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

HIGH: 7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

7.5AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Server-Side Request Forgery

Product status

Any version

affected

Timeline

2026-03-23:	Advisory disclosed
2026-03-23:	VulDB entry created
2026-03-23:	VulDB entry last update

Credits

Practice (VulDB User) reporter

References

vuldb.com/?id.352482 (VDB-352482 | DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery) vdb-entry technical-description

vuldb.com/?ctiid.352482 (VDB-352482 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.775760 (Submit #775760 | DefaultFuction CRM V1.0.0 Server-Side Request Forgery) third-party-advisory

github.com/...stomer-Relationship-Management-System/issues/2 issue-tracking

github.com/...stomer-Relationship-Management-System/issues/2 exploit issue-tracking

github.com/...ommit/f76e7123fe093b8675f88ec8f71725b0dd186310 patch

github.com/...Jeson-Customer-Relationship-Management-System/ product

cve.org (CVE-2026-4623)

nvd.nist.gov (CVE-2026-4623)

Download JSON