The impact of this vulnerability is severe, particularly for deployments utilizing Microsoft SQL Server. If the database configuration has 'xp_cmdshell' enabled, an attacker can escalate from SQL injection to remote code execution (RCE) by writing backdoor files or executing system-level commands. This vulnerability was confirmed to be actively exploited in the wild, with initial observation by the Shadowserver Foundation on February 13, 2025. Defenders should prioritize patching or restricting access to the affected web endpoint to prevent unauthorized system access.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Yonyou U8 CRM instances.
2. Attacker crafts an HTTP GET/POST request targeting the /fillbacksettingedit.php endpoint.
3. Attacker injects 'DontCheckLogin=1' into the request to bypass authentication middleware.
4. Attacker inserts malicious SQL syntax into the 'id' parameter.
5. The application backend executes the malicious SQL query against the connected Microsoft SQL Server instance.
6. Attacker leverages SQL commands to enable or utilize 'xp_cmdshell' to access the underlying host OS.
7. Attacker writes a web shell or other backdoor file to the web server's document root.
8. Attacker executes arbitrary system commands via the backdoor to maintain persistence and facilitate lateral movement.

Impact

Successful exploitation allows for full database compromise and potential remote code execution on the underlying host. This vulnerability has been observed in-the-wild, putting organizations running Yonyou U8 CRM at risk of data exfiltration, system takeover, and ransomware deployment.

Recommendation

1. Immediately restrict network access to the /fillbacksettingedit.php endpoint on all Yonyou U8 CRM instances.
2. Audit Microsoft SQL Server configurations to ensure 'xp_cmdshell' is disabled unless strictly required by business processes; if enabled, restrict permissions for the database user account used by the CRM.
3. Deploy the provided Sigma rule to web server logs to detect exploitation attempts targeting the identified vulnerable endpoint.
4. Search historical logs for requests containing 'DontCheckLogin=1' followed by unexpected SQL keywords in the 'id' parameter to identify previous compromise attempts.