A flaw in the CrontabController.php file of Zhong Bang CRMEB allows an attacker to bypass authentication checks and create, modify, or delete cron tasks remotely. The missing authorization means that unauthenticated users can manipulate scheduled tasks, which could potentially be used to execute malicious payloads or otherwise disrupt services. The attack can be launched from any location that can reach the Crontab endpoint, and the exploit has been publicly released.

Zhong Bang CRMEB versions up to and including 5.6.3 are affected. The vulnerability resides in the crontab endpoint component of the application.

The flaw has a CVSS score of 6.9, indicating moderate severity, and a very low EPSS score of less than 1 %, suggesting limited current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it remotely by sending unauthenticated requests to the /api/v1/crontab endpoint, creating, updating, or deleting scheduled tasks. The absence of authorization checks removes any prerequisite for user authentication, making exploitation straightforward once network reachability is achieved.