{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/yonyou/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yonyou:u8_crm:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-58385"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["U8 CRM"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","remote-code-execution","cve-2024-58385"],"_cs_type":"threat","_cs_vendors":["Yonyou"],"content_html":"\u003cp\u003eYonyou U8 CRM is vulnerable to an unauthenticated SQL injection flaw located within the fillbacksettingedit.php configuration endpoint. An attacker can leverage the 'DontCheckLogin=1' parameter to bypass authentication controls and subsequently inject malicious payloads into the 'id' parameter. This input is processed by the application's backend database without proper sanitization.\u003c/p\u003e\n\u003cp\u003eThe impact of this vulnerability is severe, particularly for deployments utilizing Microsoft SQL Server. If the database configuration has 'xp_cmdshell' enabled, an attacker can escalate from SQL injection to remote code execution (RCE) by writing backdoor files or executing system-level commands. This vulnerability was confirmed to be actively exploited in the wild, with initial observation by the Shadowserver Foundation on February 13, 2025. Defenders should prioritize patching or restricting access to the affected web endpoint to prevent unauthorized system access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing Yonyou U8 CRM instances.\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP GET/POST request targeting the /fillbacksettingedit.php endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects 'DontCheckLogin=1' into the request to bypass authentication middleware.\u003c/li\u003e\n\u003cli\u003eAttacker inserts malicious SQL syntax into the 'id' parameter.\u003c/li\u003e\n\u003cli\u003eThe application backend executes the malicious SQL query against the connected Microsoft SQL Server instance.\u003c/li\u003e\n\u003cli\u003eAttacker leverages SQL commands to enable or utilize 'xp_cmdshell' to access the underlying host OS.\u003c/li\u003e\n\u003cli\u003eAttacker writes a web shell or other backdoor file to the web server's document root.\u003c/li\u003e\n\u003cli\u003eAttacker executes arbitrary system commands via the backdoor to maintain persistence and facilitate lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full database compromise and potential remote code execution on the underlying host. This vulnerability has been observed in-the-wild, putting organizations running Yonyou U8 CRM at risk of data exfiltration, system takeover, and ransomware deployment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eImmediately restrict network access to the /fillbacksettingedit.php endpoint on all Yonyou U8 CRM instances.\u003c/li\u003e\n\u003cli\u003eAudit Microsoft SQL Server configurations to ensure 'xp_cmdshell' is disabled unless strictly required by business processes; if enabled, restrict permissions for the database user account used by the CRM.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to web server logs to detect exploitation attempts targeting the identified vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eSearch historical logs for requests containing 'DontCheckLogin=1' followed by unexpected SQL keywords in the 'id' parameter to identify previous compromise attempts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-15T17:42:10Z","date_published":"2026-09-15T17:42:10Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2024-58385-yonyou-sql-injection/","summary":"An unauthenticated SQL injection vulnerability in Yonyou U8 CRM allows attackers to execute arbitrary SQL commands via the fillbacksettingedit.php endpoint, potentially leading to remote code execution on MS SQL Server instances.","title":"Unauthenticated SQL Injection in Yonyou U8 CRM (CVE-2024-58385)","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2024-58385-yonyou-sql-injection/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yonyou:u8_cloud:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-54398"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["U8 Cloud"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Yonyou"],"content_html":"\u003cp\u003eYonyou U8 Cloud is affected by a critical Java deserialization vulnerability, tracked as CVE-2023-54398, residing within the \u003ccode\u003enc.impl.pub.filesystem.FileManageServlet\u003c/code\u003e component. This flaw allows unauthenticated remote attackers to trigger arbitrary OS command execution by sending a crafted serialized payload in the body of an HTTP POST request. The vulnerability stems from the \u003ccode\u003edoAction\u003c/code\u003e method, which insecurely processes incoming request body data through \u003ccode\u003eObjectInputStream.readObject()\u003c/code\u003e without implementing input validation or filtering mechanisms.\u003c/p\u003e\n\u003cp\u003eThis flaw poses a severe risk to organizations, as it bypasses standard authentication controls and provides a direct pathway for full system compromise. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability beginning on February 13, 2025. Defenders should prioritize identifying and patching instances of Yonyou U8 Cloud to prevent unauthorized access and potential downstream impacts, such as data exfiltration or the deployment of secondary malware payloads.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify internet-facing Yonyou U8 Cloud instances.\u003c/li\u003e\n\u003cli\u003eAttacker probes for the presence of the vulnerable \u003ccode\u003eFileManageServlet\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious serialized Java object payload designed to execute OS commands.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP POST request containing the serialized payload to the \u003ccode\u003edoAction\u003c/code\u003e method of the target servlet.\u003c/li\u003e\n\u003cli\u003eThe application component \u003ccode\u003enc.impl.pub.filesystem.FileManageServlet\u003c/code\u003e fails to validate the request body.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eObjectInputStream.readObject()\u003c/code\u003e method deserializes the untrusted payload.\u003c/li\u003e\n\u003cli\u003eThe deserialization process executes the embedded malicious command on the underlying host OS.\u003c/li\u003e\n\u003cli\u003eAttacker gains remote code execution, typically used for establishing persistence or further lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2023-54398 results in full, unauthenticated remote code execution on the underlying host running Yonyou U8 Cloud. Attackers can leverage this access to steal sensitive organizational data, manipulate financial information within the ERP, install persistent backdoors, or pivot deeper into the corporate network. Given the critical nature of ERP systems, the impact of such a compromise is high, potentially leading to widespread operational disruption and financial loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch all Yonyou U8 Cloud deployments to the version provided by the vendor that addresses CVE-2023-54398.\u003c/li\u003e\n\u003cli\u003eDeploy the provided webserver detection rule to identify and block incoming HTTP requests containing patterns indicative of Java object serialization.\u003c/li\u003e\n\u003cli\u003eMonitor webserver logs for high-frequency or anomalous POST requests directed at the \u003ccode\u003eFileManageServlet\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eRestrict network access to Yonyou U8 Cloud instances to only essential internal IP ranges, removing exposure from the public internet.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-15T17:42:00Z","date_published":"2026-09-15T17:42:00Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2023-54398/","summary":"Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability (CVE-2023-54398) in the FileManageServlet component, enabling remote attackers to achieve arbitrary OS command execution.","title":"Unauthenticated RCE in Yonyou U8 Cloud via Java Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2023-54398/"}],"language":"en","title":"CraftedSignal Threat Feed - Yonyou","version":"https://jsonfeed.org/version/1.1"}