A critical authentication-bypass SQL injection flaw in Yonyou U8 CRM's fillbacksettingedit.php endpoint allows remote attackers to run arbitrary SQL, and, on some Microsoft SQL Server deployments, arbitrary OS commands, from an unauthenticated network position.
What Is It
CVE-2024-58385 is an unauthenticated SQL injection vulnerability (CWE-89) in the Yonyou U8 CRM configuration endpoint fillbacksettingedit.php. Two defects chain together: the DontCheckLogin=1 parameter bypasses authentication entirely, and the id parameter is incorporated into SQL queries without sanitization. The result is arbitrary SQL execution against the application database from an unauthenticated network position.
The flaw carries a CVSS v4.0 base score of 9.3 (Critical): vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, reflecting network-reachable exploitation with low complexity, no attack requirements, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. The record was published by VulnCheck as the CNA.
Why It Matters
SQL injection alone is severe here, but the impact escalates on Microsoft SQL Server deployments where xp_cmdshell is enabled: attackers can write backdoor files and execute arbitrary operating system commands, turning a database flaw into full host compromise.
The combination of no authentication requirement, a network-reachable endpoint, and a publicly documented exploitation path makes internet-exposed U8 CRM instances a high-priority exposure. Public technical writeups describing the request chain are already circulating, which lowers the bar for opportunistic scanning and exploitation.
No CISA KEV entry was supplied for this CVE, so no federal Known Exploited Vulnerabilities catalog listing or BOD 22-01 remediation deadline is confirmed by the source material.
What's Vulnerable
Yonyou U8 CRM, with the following versions marked affected by the vendor-supplied data:
- 18
- 16.5
- 16.1
- 16.0
- 15.1
- 13
All other versions default to "unaffected" in the CVE record. No CPE match strings were published with the entry.
Patch Status
The supplied data does not state a fixed version or specific remediation steps. Yonyou has published a security notice referenced in the CVE record (notice ID 618), which is the authoritative source for vendor guidance. Operators should consult that advisory directly, restrict external exposure of the CRM interface, and, where MSSQL backs the deployment, confirm xp_cmdshell is disabled.
Sources
- NVD, CVE-2024-58385: https://nvd.nist.gov/vuln/detail/CVE-2024-58385
- VulnCheck Advisory; Yonyou U8 CRM SQL Injection via fillbacksettingedit.php: https://www.vulncheck.com/advisories/yonyou-u8-crm-sql-injection-via-fillbacksettingedit-php
- Yonyou Security Notice (ID 618): https://security.yonyou.com/#/noticeInfo?id=618
- CN-SEC Technical Writeup: https://cn-sec.com/archives/3234745.html
- Yonyou (vendor): https://www.yonyou.com/Global/