External risk intelligence

Entersoft CRM Arbitrary File Upload Vulnerability Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-46088

The vulnerability exists in a Customer Resource Management (CRM) system. CRM platforms are commonly deployed as internet-facing web applications to facilitate remote access for employees or client interactions, making them frequently accessible from the public internet.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An arbitrary file upload vulnerability has been identified in a customer resource management system. This issue could allow attackers to execute code by uploading a malicious file, potentially impacting the integrity and availability of the system. The primary concern is to confirm if this specific technology is in use and assess any potential exposure.

Attackers can upload malicious files to execute code.
Matters if using the identified customer resource system.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a specially crafted file through the ProductAction.entphone interface. This interface, part of the Zhejiang University Entersoft Customer Resource Management System, lacks proper validation, allowing malicious files to be uploaded. Once uploaded, this file can lead to arbitrary code execution on the system.

Unauthenticated access to the ProductAction.entphone interface.
Uploading a malicious file.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to upload and execute arbitrary code on the server, potentially impacting system integrity and data confidentiality when supported by the advisory.

System files could be compromised.
Malicious files can be uploaded.
Unauthorized code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Zhejiang University Entersoft Customer Resource Management System requires action from teams responsible for application security and infrastructure, as it allows for unauthenticated code execution. The first practical step is to identify all instances of the affected CRM system, assess their exposure and business criticality, and locate the accountable owner for remediation planning.

Application owners and infrastructure teams should own this.
Verify system reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Zhejiang University Entersoft CRM system?

This is a Customer Resource Management (CRM) platform designed to help organizations track client data and interactions. It functions as a web-based application, which requires a server environment to host the interface and manage incoming data requests for business operations.

What does CVE-2024-46088 mean by arbitrary file upload?

This vulnerability, classified as CWE-434, describes a flaw where the software fails to properly check the content or type of files uploaded by users. Because the system does not restrict these uploads, an attacker can submit a malicious file containing custom commands, which the server may then execute as if it were a legitimate part of the application.

How does an attacker trigger this vulnerability?

An attacker targets the ProductAction.entphone interface specifically. The vulnerability is triggered when this interface accepts a malicious file without validation. Simply visiting the login page or using the CRM for standard business tasks does not trigger the bug; the attacker must intentionally send a specially crafted file to that specific interface to initiate the execution process.

Do I need to worry about this if my CRM is internal?

Halo Surface Signal indicates that CRM platforms are often deployed as internet-facing web applications to allow for remote access, which increases the likelihood that your system is exposed to external threats. If your instance is truly isolated from the public internet, it may be at lower risk, though you should verify that it is not reachable through any VPN or internal portal that might provide a path for an attacker.

What should I do first if I run this CRM software?

Begin by creating a comprehensive inventory of all servers running the affected Entersoft CRM software. Once you have identified these systems, evaluate their current network reachability and determine which business units are responsible for them. Your goal is to confirm which instances are active and to prepare your team to coordinate remediation efforts with the designated application owners.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.