CVE-2024-58385: Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xpcmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or block use of the DontCheckLogin=1 parameter for the fillbacksettingedit.php endpoint so unauthenticated requests cannot bypass login.
Yonyou U8 CRM (fillbacksettingedit.php) DontCheckLogin = 1 (do not allow/disable the authentication bypass) - Compensating control
If xp_cmdshell is enabled in Microsoft SQL Server deployments, disable xp_cmdshell to prevent exploitation from writing backdoor files and executing arbitrary operating system commands.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any remote attacker can exploit it without authentication or user interaction. The affected endpoint accepts DontCheckLogin=1 to bypass authentication, and the id parameter is used in SQL queries without sanitization.
What is the practical impact on Microsoft SQL Server deployments?
An attacker can execute arbitrary SQL commands. If xp_cmdshell is enabled, they may also write backdoor files and execute arbitrary operating system commands on the server.
How can I tell whether exploitation has occurred?
Review access and application logs for requests to fillbacksettingedit.php, particularly requests containing DontCheckLogin=1 and suspicious id parameter values. Also investigate unexpected SQL activity, newly written files, or operating system command execution where xp_cmdshell is enabled.
Is there evidence of active exploitation?
Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.