---
cve: "CVE-2024-56908"
severity: "MEDIUM"
cvss: 6.8
epss: "0.6%"
vendor: "n/a"
kev: false
exploited: false
published: "2025-02-13 00:00:00"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-01T19:30:19+01:00"
---

# CVE-2024-56908

> 6.8 MEDIUM · 🧪 PoC

## Beschreibung

In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker can bypass restrictions and upload arbitrary files to directories of their choice, potentially leading to remote code execution or server compromise.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2025-03-17 18:48:25

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Hoch | good |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-1287** — Improper Validation of Specified Type of Input
  The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
- **CWE-444** — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

## Referenzen

- <https://gist.github.com/JuyLang/7406077e3e5e6b2ff35c80f1853e298f>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-56908/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_