by Kastro CVE-2025-8345
Shanghai Lingdang Information Technology Lingdang CRM — Shanghai Lingdang Information Technology Lingdang CRM yunzhijiaApi.php delete_user sql injection
Description · from the CVE record
A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function delete_user of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component.
Affected
ProductAffectedFixed inSource
Lingdang CRM8.6.4.08.6.5.2CNA
Lingdang CRM8.6.4.18.6.5.2CNA
Lingdang CRM8.6.4.28.6.5.2CNA
Lingdang CRM8.6.4.38.6.5.2CNA
Lingdang CRM8.6.4.48.6.5.2CNA
Lingdang CRM8.6.4.58.6.5.2CNA
Lingdang CRM8.6.4.68.6.5.2CNA
Lingdang CRM8.6.4.78.6.5.2CNA
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDB (CNA)6.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
VulDB (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial