CVE-2022-3342

The Jetpack CRM plugin before version 5.4.0 contains a PHAR deserialization vulnerability in the 'zeroBSCRM_CSVImporterLitehtml_app' function that accepts user input through the 'zbscrmcsvimpf' parameter. Although the function includes a nonce verification step, the check fails silently without halting execution, allowing a 'file_exists' operation to proceed with attacker-controlled values including phar:// archive paths, which triggers unintended object deserialization. An unauthenticated attacker can exploit this by uploading a malicious phar archive and convincing an administrator to interact with a specially crafted link, enabling arbitrary object injection on the site.

Based on public CVE data (MITRE/NVD).