Yonyou U8 CRM Unauthenticated SQL Injection (CVE-2024-58385)

Technical Analysis

CVE-2024-58385 stems from improper input validation in the fillbacksettingedit.php configuration endpoint of Yonyou U8 CRM, where the DontCheckLogin=1 query parameter disables authentication checks entirely, exposing the id parameter to direct SQL injection. Attackers can leverage this to extract sensitive database contents or, on MSSQL deployments with xp_cmdshell enabled, execute arbitrary OS commands and drop backdoor files, achieving full server compromise. The Shadowserver Foundation confirmed active exploitation attempts beginning 2025-02-13, indicating this is being weaponized by opportunistic scanning campaigns targeting internet-facing instances. Given a CVSS score of 9.8, this vulnerability requires no authentication or user interaction, making it highly attractive for automated exploitation and initial access brokering. Organizations running AI agents or automation pipelines that integrate with Yonyou U8 CRM for CRM data retrieval, ticket automation, or business process orchestration could have their underlying credentials, database connections, or agent-accessible API keys exposed if the compromised host is part of the same network segment as agent infrastructure.

Affected Systems

Yonyou U8 CRM software, specifically the fillbacksettingedit.php endpoint; deployments backed by Microsoft SQL Server with xp_cmdshell stored procedure enabled are at highest risk of full RCE

Indicators of Compromise

• Endpoint pattern: /fillbacksettingedit.php?DontCheckLogin=1&id=[SQLi payload]
• Suspicious xp_cmdshell invocation logs on MSSQL servers hosting Yonyou U8 CRM
• Unexpected webshell/backdoor files written to CRM web root directories
• Anomalous outbound connections from Yonyou U8 CRM hosts following SQL query execution

Remediation Steps

1. 1

   Apply Vendor Patch

   Upgrade Yonyou U8 CRM to the latest patched version that addresses CVE-2024-58385; contact Yonyou support if no official patch is yet available.

2. 2

   Disable xp_cmdshell

   Disable the xp_cmdshell stored procedure on all Microsoft SQL Server instances backing Yonyou U8 CRM unless explicitly required, and restrict permissions if it must remain enabled.

3. 3

   Restrict Endpoint Access

   Implement network-level access controls (firewall/WAF rules) to block or restrict access to fillbacksettingedit.php from untrusted sources, and block requests containing DontCheckLogin=1 from external networks.

4. 4

   Monitor for Exploitation

   Deploy detection rules for known exploitation patterns targeting this endpoint, and review logs for signs of SQL injection attempts or unauthorized xp_cmdshell usage since 2025-02-13.

5. 5

   Isolate and Audit Affected Hosts

   Segment CRM/database servers from sensitive internal networks including any AI agent or automation infrastructure, and audit for unauthorized backdoor files or persistence mechanisms.