Executive brief
Yonyou U8 CRM is an enterprise customer relationship management system used by organizations to manage sales and customer interactions. The vulnerability allows unauthenticated attackers to bypass authentication and inject malicious SQL commands through a web interface, potentially leading to complete database compromise, data theft, and arbitrary code execution on Windows servers running Microsoft SQL Server with extended features enabled.
Technical details
The vulnerability is an unauthenticated SQL injection flaw in the fillbacksettingedit.php endpoint where the DontCheckLogin=1 parameter bypasses authentication checks and the id parameter is passed directly into SQL queries without sanitization. Attackers can craft malicious SQL UNION SELECT statements to extract sensitive data or, on Microsoft SQL Server deployments with xp_cmdshell enabled, execute arbitrary operating system commands and write backdoor files. The attack requires only network access to the vulnerable endpoint and no authentication credentials. Patches are available from the vendor; affected versions include V13 through V18.
Affected products
- Yonyou U8 CRM V13, V15.1, V16.0, V16.1, V16.5, V18
Timeline
- 2025-02-13: exploited: Exploitation evidence observed by Shadowserver Foundation
- 2024-10-06: disclosed
- 2026-09-15: advisory
- 2024-09-25: patched: Patch available (20240925.zip) from vendor security center