CVE-2024-58385

Yonyou U8 CRM ships an unauthenticated SQL injection flaw in the fillbacksettingedit.php configuration endpoint, where appending DontCheckLogin=1 bypasses authentication and the unsanitized id parameter is spliced directly into SQL queries. An unauthenticated remote attacker can send a crafted request to this endpoint to execute arbitrary SQL against the backend database. On deployments backed by Microsoft SQL Server with xp_cmdshell enabled, the attacker can escalate from SQL injection to writing backdoor files and running arbitrary operating system commands on the server. Affected systems are Yonyou U8 CRM installations (specific version ranges were not stated in the disclosure), which are primarily internet-facing enterprise CRM deployments in China. Exploitation of this vulnerability was first observed in the wild by the Shadowserver Foundation on 2025-02-13, so defenders should treat it as actively attacked.

What to do: Immediately restrict or take internet-facing U8 CRM instances off public exposure (VPN/IP allowlisting), and apply the vendor's patch once available since no fixed version is stated in the disclosure. Block or closely monitor requests to fillbacksettingedit.php (including the DontCheckLogin parameter) at the WAF or reverse proxy. On the database side, disable xp_cmdshell if not required, review MSSQL logs for unexpected command execution or unfamiliar jobs/accounts, and hunt for webshells or backdoor files dropped on the application server, given confirmed in-the-wild exploitation since February 2025.