Yonyou U8 CRM — CVE-2024-58385 (Critical)

Summary

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Yonyou U8 CRM. Patch or mitigate promptly.

Operator check

Review CVE-2024-58385 in your asset inventory. Apply patches per vendor guidance and verify U8 CRM is not exposed. CVSS score: 9.8.

Sources