CVE-2026-41453 in laravel-crm
Summary
by MITRE • 08/03/2026
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within Krayin CRM versions prior to 224 where an authenticated attacker with leads access privileges can execute blind sql injection attacks through the leads DataGrid functionality. The flaw specifically manifests in the LeadDataGrid.php file where the rotten_lead[in] query parameter is directly concatenated into a havingRaw() database call without proper parameterized input handling. This represents a critical security weakness that violates fundamental secure coding practices and aligns with CWE-89 which categorizes improper neutralization of special elements used in sql commands as a primary cause of sql injection vulnerabilities.
The technical exploitation occurs through manipulation of the rotten_lead[in] parameter within the HAVING clause of database queries, allowing attackers to craft malicious sql payloads that bypass normal input validation mechanisms. Attackers can leverage time-based and boolean-based blind sql injection techniques to systematically extract database contents without direct error messages, making detection more challenging. The vulnerability enables comprehensive data exfiltration including user credential hashes stored within the application's database, sensitive CRM records containing customer information, and critical application configuration data that could compromise system integrity and confidentiality.
The operational impact of this vulnerability is severe as it provides attackers with complete database access once they obtain valid leads access credentials. This compromises the principle of least privilege since a single authenticated user account can potentially expose all stored data within the crm system. The vulnerability affects the availability, integrity, and confidentiality aspects of the information security triad, enabling unauthorized data disclosure, modification, and potential service disruption. Organizations using affected versions face significant risk of data breaches and regulatory compliance violations.
Mitigation strategies should include immediate patching to version 224 or later where parameterized queries are properly implemented in the LeadDataGrid.php file. Security teams must also implement input validation and sanitization measures at multiple layers including application firewalls, database query monitoring, and regular security code reviews. The vulnerability demonstrates the importance of proper sql injection prevention techniques as outlined in the OWASP top ten and aligns with ATT&CK technique T10713 for application layer protocol manipulation. Organizations should also implement principle of least privilege access controls and regularly audit user permissions to minimize potential damage from compromised accounts.