Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2024-58385Yonyou U8 CRM SQL Injection via fillbacksettingedit.php

Critical 9.8

In plain English

A critical-severity SQL injection in U8 CRM from Yonyou. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 47.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Affected products (as reported)

Vendor	Product	Versions
Yonyou	U8 CRM	1816.516.116.015.113

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Vendor Advisory vendor-advisory, patch
CN-SEC Blog technical-description, exploit
Vendor Homepage product
https://www.vulncheck.com/advisories/yonyou-u8-crm-sql-injection-via-fillbacksettingedit-php third-party-advisory