CVE-2025-8345
📋 TL;DR
This critical SQL injection vulnerability in Shanghai Lingdang Information Technology's Lingdang CRM allows remote attackers to execute arbitrary SQL commands via the delete_user function. Affected systems include Lingdang CRM versions up to 8.6.4.7, potentially exposing sensitive customer data and system integrity.
💻 Affected Systems
- Shanghai Lingdang Information Technology Lingdang CRM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive CRM data including customer information, business records, and potentially authentication credentials.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit code has been publicly disclosed on GitHub, making exploitation straightforward for attackers with basic SQL injection knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.6.5.2
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
1. Backup current CRM installation and database. 2. Download version 8.6.5.2 from official vendor source. 3. Replace affected files or perform full upgrade following vendor documentation. 4. Test functionality before deploying to production.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and parameterized queries for the delete_user function arguments
Not applicable - requires code modification
Web Application Firewall Rules
allDeploy WAF rules to block SQL injection patterns targeting the vulnerable endpoint
Not applicable - WAF configuration dependent
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the CRM application
- Deploy a web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check CRM version in admin panel or examine crm/WeiXinApp/yunzhijia/yunzhijiaApi.php file for vulnerable delete_user functionCheck Version:
Check admin panel or examine application configuration files for version informationVerify Fix Applied:
Verify CRM version is 8.6.5.2 or later and test delete_user functionality with SQL injection test payloads📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed delete_user attempts
- SQL error messages in application logs
Network Indicators:
- HTTP POST requests to yunzhijiaApi.php with SQL injection patterns in parameters
SIEM Query:
source="web_logs" AND uri="*yunzhijiaApi.php*" AND (param="*DELETE*" OR param="*SELECT*" OR param="*UNION*")