CVE-2024-58385: Yonyou U8 CRM SQLI Vulnerability

CVE-2024-58385 Overview

CVE-2024-58385 is an unauthenticated SQL injection vulnerability in Yonyou U8 CRM. The flaw resides in the fillbacksettingedit.php configuration endpoint, where the DontCheckLogin=1 parameter bypasses authentication controls. The id parameter is then concatenated into SQL queries without sanitization, allowing attackers to execute arbitrary SQL commands remotely.

On Microsoft SQL Server deployments with xp_cmdshell enabled, attackers can escalate the SQL injection to write backdoor files and execute arbitrary operating system commands. The Shadowserver Foundation first observed exploitation evidence on 2025-02-13.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL statements and, on affected MSSQL backends, achieve operating system command execution and persistent backdoor deployment.

Affected Products

Yonyou U8 CRM (configuration endpoint fillbacksettingedit.php)
Deployments backed by Microsoft SQL Server with xp_cmdshell enabled are at elevated risk of full host compromise
Refer to the Yonyou Security Notice #618 for vendor-confirmed affected versions

Discovery Timeline

2025-02-13 - Exploitation activity first observed in the wild by the Shadowserver Foundation
2026-09-15 - CVE-2024-58385 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2024-58385

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] compounded by an authentication bypass. The fillbacksettingedit.php endpoint honors a DontCheckLogin=1 query parameter that instructs the application to skip session and login validation. This design decision exposes the endpoint to unauthenticated network callers.

Once authentication is bypassed, the id parameter is passed directly into a backend SQL statement without parameterization or input filtering. Attackers can inject arbitrary SQL syntax, including stacked queries, union-based extraction, and time-based blind techniques. On Microsoft SQL Server, adversaries can invoke xp_cmdshell to spawn operating system processes when the extended stored procedure is enabled.

Root Cause

Two distinct defects combine to produce a critical exposure. First, the presence of a DontCheckLogin bypass parameter in production code eliminates the authentication boundary. Second, the endpoint constructs SQL through string concatenation of the id parameter rather than using prepared statements or parameterized queries.

Attack Vector

Exploitation requires only network access to the vulnerable HTTP endpoint. An attacker issues a crafted request to fillbacksettingedit.php with DontCheckLogin=1 and a malicious id value. In MSSQL environments with xp_cmdshell enabled, the injection chain is used to write ASP or JSP webshells to the web root and execute arbitrary commands as the SQL Server service account.

Proof-of-concept details and payload analysis are documented in the VulnCheck Advisory and the CN-Sec technical writeup.

Detection Methods for CVE-2024-58385

Indicators of Compromise

HTTP requests to fillbacksettingedit.php containing the DontCheckLogin=1 parameter from external or untrusted sources
Requests to the id parameter containing SQL metacharacters such as single quotes, EXEC, xp_cmdshell, WAITFOR DELAY, UNION SELECT, or hex-encoded payloads
Newly created ASP, ASPX, or JSP files in Yonyou U8 CRM web directories that were not present in known-good baselines
Child processes spawned by the SQL Server service account (sqlservr.exe) such as cmd.exe, powershell.exe, or certutil.exe

Detection Strategies

Deploy web application firewall (WAF) rules that block or alert on DontCheckLogin=1 parameter usage on any Yonyou endpoint
Inspect IIS, Apache, or Nginx access logs for GET/POST requests to fillbacksettingedit.php and correlate with response sizes and status codes
Enable MSSQL auditing for xp_cmdshell invocations and unusual sp_configure changes
Hunt for anomalous process ancestry where sqlservr.exe spawns interactive shells or download utilities

Monitoring Recommendations

Alert on outbound network connections initiated by the SQL Server or IIS worker process to non-corporate destinations
Monitor file integrity of web-accessible directories used by Yonyou U8 CRM for unauthorized file creation or modification
Baseline and monitor authentication log volume for Yonyou U8 CRM; sudden drops may indicate widespread auth-bypass exploitation

How to Mitigate CVE-2024-58385

Immediate Actions Required

Apply the vendor patch referenced in Yonyou Security Notice #618 to all Yonyou U8 CRM installations
Restrict network access to the Yonyou U8 CRM management interfaces so they are not reachable from the public internet
Disable xp_cmdshell on backing Microsoft SQL Server instances unless explicitly required by a documented business process
Audit web roots for unauthorized ASP/JSP files and review MSSQL logs for xp_cmdshell calls dated on or after 2025-02-13

Patch Information

Yonyou has published guidance and remediation instructions in Security Notice #618. Additional advisory context is available from the VulnCheck Advisory. Administrators should validate patch application by confirming that DontCheckLogin=1 requests to fillbacksettingedit.php are rejected and that the id parameter is properly parameterized.

Workarounds

Block requests containing DontCheckLogin=1 at the reverse proxy or WAF layer until patching is complete
Remove or comment out the fillbacksettingedit.php endpoint if it is not required in the deployment
Enforce least privilege on the SQL Server service account so that command execution, if achieved, is contained
Place the application behind a VPN or zero-trust access proxy to eliminate unauthenticated internet exposure

bash

# Disable xp_cmdshell on Microsoft SQL Server to break the command execution chain
sqlcmd -S <server> -Q "EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;"