by Kastro
Paper/Archive/CVE-2024-58385

CVE-2024-58385

Yonyou U8 CRM — Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.8.528 × 2010.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Affected

ProductAffectedFixed inSource
U8 CRM18–CNA
U8 CRM16.5–CNA
U8 CRM16.1–CNA
U8 CRM16.0–CNA
U8 CRM15.1–CNA
U8 CRM13–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

patchsecurity.yonyou.com/#/noticeInfo?id=618exploitcn-sec.com/archives/3234745.htmlrefyonyou.com/Globalwriteupvulncheck.com/advisories/yonyou-u8-crm-sql-injection-via-fillbacksettingedit-php