CVE-2024-58385

CriticalCVSS 9.8/10Last modified Sep 28, 2026

Description

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-583866.5ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read ar CVE-2024-583877.5Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenti CVE-2024-583887.5Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote at CVE-2024-583896.1HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect user CVE-2024-58396.5Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit he CVE-2024-583908.8Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action th CVE-2024-583914.3Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not CVE-2024-583923.3PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers to read past name buf CVE-2024-583938.2i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attack CVE-2024-583946.1Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying mali CVE-2024-583967.5YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary f CVE-2024-583976.1MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations v