CVE-2025-8345 in Lingdang CRM
Summary
by MITRE • 07/31/2025
A vulnerability classified as critical was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. Affected by this vulnerability is the function delete_user of the file crm/WeiXinApp/yunzhijia/yunzhijiaApi.php. The manipulation of the argument function leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5.2 is able to address this issue. It is recommended to upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2025
This critical sql injection vulnerability exists in the Shanghai Lingdang Information Technology Lingdang CRM software version 8.6.4.7 and earlier, representing a severe security risk that can be exploited remotely. The vulnerability specifically affects the delete_user function within the crm/WeiXinApp/yunzhijia/yunzhijiaApi.php file, where improper input validation allows attackers to manipulate sql query parameters. The flaw enables an attacker to inject malicious sql code through the function argument, potentially gaining unauthorized access to the underlying database system. This vulnerability has been publicly disclosed and is actively being used in the wild, making it particularly dangerous for organizations that have not yet patched their systems.
The technical implementation of this vulnerability demonstrates a classic sql injection flaw that aligns with CWE-89, which specifically addresses improper neutralization of special elements used in sql commands. The attack vector is remote, meaning that an attacker can exploit this vulnerability without requiring physical access to the system, and the impact extends beyond simple data theft to potentially allowing full database compromise. The vulnerability's exploitation capability has been confirmed through public disclosure, indicating that threat actors are actively targeting systems running the affected version of the Lingdang CRM software. This represents a significant operational risk for organizations relying on this customer relationship management platform.
The operational impact of this vulnerability is substantial and multifaceted, potentially allowing attackers to execute arbitrary sql commands, extract sensitive customer data, modify database records, or even escalate privileges within the database environment. Organizations using the affected Lingdang CRM version face risks of data breaches, regulatory compliance violations, and potential system compromise that could affect business continuity. The vulnerability's remote exploitation capability means that organizations cannot rely on network segmentation or firewall rules as complete protection measures. According to ATT&CK framework, this vulnerability maps to T1190 - Exploit Public-Facing Application, indicating that the attack surface includes externally accessible web applications that are commonly targeted by threat actors.
Organizations should immediately prioritize upgrading to version 8.6.5.2 to remediate this vulnerability, as this specific version contains the necessary patches to address the sql injection flaw. Additional mitigations include implementing web application firewalls, conducting comprehensive network monitoring for suspicious sql query patterns, and performing thorough vulnerability assessments of the affected application components. Security teams should also consider implementing database activity monitoring to detect and respond to potential exploitation attempts. The vulnerability's classification as critical underscores the urgency of remediation efforts, as the combination of public exploit availability and remote attack capability creates an immediate threat to organizational security. Regular security assessments and patch management procedures should be reinforced to prevent similar vulnerabilities from emerging in other components of the organization's software ecosystem.