{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ayonyouu8_crm/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yonyou:u8_crm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-58385"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["U8 CRM"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","remote-code-execution","cve-2024-58385"],"_cs_type":"threat","_cs_vendors":["Yonyou"],"content_html":"\u003cp\u003eYonyou U8 CRM is vulnerable to an unauthenticated SQL injection flaw located within the fillbacksettingedit.php configuration endpoint. An attacker can leverage the 'DontCheckLogin=1' parameter to bypass authentication controls and subsequently inject malicious payloads into the 'id' parameter. This input is processed by the application's backend database without proper sanitization.\u003c/p\u003e\n\u003cp\u003eThe impact of this vulnerability is severe, particularly for deployments utilizing Microsoft SQL Server. If the database configuration has 'xp_cmdshell' enabled, an attacker can escalate from SQL injection to remote code execution (RCE) by writing backdoor files or executing system-level commands. This vulnerability was confirmed to be actively exploited in the wild, with initial observation by the Shadowserver Foundation on February 13, 2025. Defenders should prioritize patching or restricting access to the affected web endpoint to prevent unauthorized system access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing Yonyou U8 CRM instances.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET/POST request targeting the /fillbacksettingedit.php endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects 'DontCheckLogin=1' into the request to bypass authentication middleware.\u003c/li\u003e\n\u003cli\u003eAttacker inserts malicious SQL syntax into the 'id' parameter.\u003c/li\u003e\n\u003cli\u003eThe application backend executes the malicious SQL query against the connected Microsoft SQL Server instance.\u003c/li\u003e\n\u003cli\u003eAttacker leverages SQL commands to enable or utilize 'xp_cmdshell' to access the underlying host OS.\u003c/li\u003e\n\u003cli\u003eAttacker writes a web shell or other backdoor file to the web server's document root.\u003c/li\u003e\n\u003cli\u003eAttacker executes arbitrary system commands via the backdoor to maintain persistence and facilitate lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full database compromise and potential remote code execution on the underlying host. This vulnerability has been observed in-the-wild, putting organizations running Yonyou U8 CRM at risk of data exfiltration, system takeover, and ransomware deployment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately restrict network access to the /fillbacksettingedit.php endpoint on all Yonyou U8 CRM instances.\u003c/li\u003e\n\u003cli\u003eAudit Microsoft SQL Server configurations to ensure 'xp_cmdshell' is disabled unless strictly required by business processes; if enabled, restrict permissions for the database user account used by the CRM.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to web server logs to detect exploitation attempts targeting the identified vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eSearch historical logs for requests containing 'DontCheckLogin=1' followed by unexpected SQL keywords in the 'id' parameter to identify previous compromise attempts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-15T17:42:10Z","date_published":"2026-09-15T17:42:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2024-58385-yonyou-sql-injection/","summary":"An unauthenticated SQL injection vulnerability in Yonyou U8 CRM allows attackers to execute arbitrary SQL commands via the fillbacksettingedit.php endpoint, potentially leading to remote code execution on MS SQL Server instances.","title":"Unauthenticated SQL Injection in Yonyou U8 CRM (CVE-2024-58385)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2024-58385-yonyou-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:yonyou:u8_crm:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}