CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
Unauthenticated SQL injection in Yonyou U8 CRM allows attackers to execute arbitrary SQL commands and potentially OS commands via xp_cmdshell.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58385?
CVE-2024-58385 is a critical SQL injection vulnerability in Yonyou U8 CRM, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Weakness: CWE-89
Which versions are affected by CVE-2024-58385?
How do I fix CVE-2024-58385?
No fix has been published for CVE-2024-58385 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-58385 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58385 exists.
Sources
Also known as GHSA-mr5w-wpqv-h82f.