Blind SQL Injection in Krayin CRM leads DataGrid

Krayin CRM versions prior to 2.2.4 are vulnerable to a blind SQL injection vulnerability within the leads DataGrid component. The vulnerability arises because the application fails to properly sanitize or parameterize input provided to the 'rotten_lead[in]' query parameter before passing it to a 'havingRaw()' call in 'LeadDataGrid.php'. An authenticated user with sufficient permissions to access the leads module can leverage this flaw to inject arbitrary SQL statements. By employing time-based or boolean-based blind injection techniques, an attacker can systematically extract sensitive information from the underlying database, including user credential hashes, CRM contact records, and application configuration metadata. This vulnerability poses a significant risk to the confidentiality of data stored within the CRM.

Impact

Successful exploitation allows an authenticated attacker to perform unauthorized database queries, leading to full exfiltration of CRM data, user credentials, and application secrets. This impact is rated with a CVSS v3.1 base score of 8.8, indicating high potential for data breach and compromise of organizational intelligence contained within the CRM.

Recommendation

• Upgrade all Krayin CRM instances to version 2.2.4 or later immediately to patch CVE-2026-41453.
• Audit application access logs for unusual patterns in the 'rotten_lead[in]' parameter, particularly involving SQL keywords such as 'SLEEP', 'BENCHMARK', 'AND', 'OR', or 'UNION'.
• Restrict access to the leads DataGrid module to a strictly defined subset of users until the patch can be applied.