CVE-2025-0463
📋 TL;DR
This critical vulnerability in Shanghai Lingdang Information Technology's Lingdang CRM allows remote attackers to upload arbitrary files without authentication by manipulating the 'name' parameter in a specific URL. This affects all installations of Lingdang CRM up to version 8.6.0.0 that have the vulnerable component exposed.
💻 Affected Systems
- Shanghai Lingdang Information Technology Lingdang CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, ransomware deployment, or creation of persistent backdoors.
Likely Case
Webshell upload enabling unauthorized access, data exfiltration, and lateral movement within the network.
If Mitigated
File upload limited to non-executable types with proper validation and access controls in place.
🎯 Exploit Status
Exploit details are publicly available in GitHub documentation. The attack requires no authentication and has simple parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Contact Shanghai Lingdang Information Technology for patch information. 2. Monitor vendor communications for security updates. 3. Consider upgrading to any version beyond 8.6.0.0 if available.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests to the vulnerable endpoint with suspicious parameters
WAF rule: Block requests matching pattern: /crm/weixinmp/index.php.*name=.*\.(php|asp|jsp|exe|sh|pl)
File Upload Restriction
linuxConfigure web server to block execution of uploaded files in upload directories
Apache: <Location "/crm/uploads/"> php_flag engine off </Location>
Nginx: location ~ ^/crm/uploads/.*\.(php|php5|php7)$ { deny all; }
🧯 If You Can't Patch
- Block external access to /crm/weixinmp/ directory at network perimeter
- Implement strict file upload validation and store uploaded files outside web root
🔍 How to Verify
Check if Vulnerable:
Attempt to access the vulnerable URL: /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin with a malicious name parameterCheck Version:
Check CRM admin panel or configuration files for version informationVerify Fix Applied:
Test the same exploit attempt after implementing controls - should receive access denied or validation error📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /crm/weixinmp/index.php with file upload parameters
- Unusual file creations in upload directories
- Webshell-like file names in web directories
Network Indicators:
- POST requests to vulnerable endpoint with file upload content
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/crm/weixinmp/index.php" AND (params CONTAINS "name=" OR params CONTAINS "upload")