CVE-2024-58385
CRITICAL · 9.8In-the-wild exploitation documented by Shadowserver; high CVSS; social repetition of advisory, not KEV-listed yet.
What: Unauthenticated SQL injection in Yonyou U8 CRM fillbacksettingedit.php endpoint (CVSS 9.8 CRITICAL) allowing arbitrary SQL execution and OS command execution on MSSQL with xp_cmdshell.
Why it matters: No authentication required; exploitation confirmed in-the-wild by Shadowserver Foundation on 2025-02-13. CVSS 9.8 reflects severity. Not yet KEV-listed but active exploitation signal is strong and documented by authoritative researcher.
Where it's seen: Social chatter across Bluesky repeating NVD advisory text; posts emphasizing "anyone can access" and database/file manipulation risk. No public PoC drops observed in posts, but Shadowserver evidence dates back seven months.
RISK: CRITICAL — Unauthenticated remote code execution confirmed exploited in wild; CVSS 9.8.
Description
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High