CVE-2024-58385

Name of the Vulnerable Software and Affected Versions Yonyou U8 CRM (affected versions not specified)

Description An unauthenticated SQL injection exists in the 'fillbacksettingedit.php' endpoint. By using the DontCheckLogin=1 parameter, authentication is bypassed, and the id parameter is incorporated into SQL queries without proper sanitization. This allows attackers to execute arbitrary SQL commands. In environments using Microsoft SQL Server with xp cmdshell enabled, this can lead to the creation of backdoor files and the execution of arbitrary operating system commands. Exploitation was first observed by the Shadowserver Foundation on 2025-02-13.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.