← Back to the live CVE advisory feed

CVE-2024-58385: U8 CRM

Severity

9.3 (CRITICAL)

Vendor

YONYOU

Affected versions

18; 16.5; 16.1

Patch status

Unknown

Published

2026-09-15T17:17:09.697

Modified

2026-09-15T17:17:09.697

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

View the official NVD record for CVE-2024-58385

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.