{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/krayin-crm--2.2.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-41453"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Krayin CRM (\u003c 2.2.4)"],"_cs_severities":["high"],"_cs_tags":["sqli","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["Krayin"],"content_html":"\u003cp\u003eKrayin CRM versions prior to 2.2.4 are vulnerable to a blind SQL injection vulnerability within the leads DataGrid component. The vulnerability arises because the application fails to properly sanitize or parameterize input provided to the 'rotten_lead[in]' query parameter before passing it to a 'havingRaw()' call in 'LeadDataGrid.php'. An authenticated user with sufficient permissions to access the leads module can leverage this flaw to inject arbitrary SQL statements. By employing time-based or boolean-based blind injection techniques, an attacker can systematically extract sensitive information from the underlying database, including user credential hashes, CRM contact records, and application configuration metadata. This vulnerability poses a significant risk to the confidentiality of data stored within the CRM.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to perform unauthorized database queries, leading to full exfiltration of CRM data, user credentials, and application secrets. This impact is rated with a CVSS v3.1 base score of 8.8, indicating high potential for data breach and compromise of organizational intelligence contained within the CRM.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Krayin CRM instances to version 2.2.4 or later immediately to patch CVE-2026-41453.\u003c/li\u003e\n\u003cli\u003eAudit application access logs for unusual patterns in the 'rotten_lead[in]' parameter, particularly involving SQL keywords such as 'SLEEP', 'BENCHMARK', 'AND', 'OR', or 'UNION'.\u003c/li\u003e\n\u003cli\u003eRestrict access to the leads DataGrid module to a strictly defined subset of users until the patch can be applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-03T18:06:32Z","date_published":"2026-08-03T18:06:32Z","id":"https://feed.craftedsignal.io/briefs/2026-08-krayin-crm-sqli/","summary":"Krayin CRM versions prior to 2.2.4 contain a blind SQL injection vulnerability in the leads DataGrid, allowing authenticated attackers to exfiltrate database contents via the rotten_lead[in] query parameter.","title":"Blind SQL Injection in Krayin CRM leads DataGrid","url":"https://feed.craftedsignal.io/briefs/2026-08-krayin-crm-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Krayin CRM (\u003c 2.2.4)","version":"https://jsonfeed.org/version/1.1"}