CVE-2024-58385

Executive Summary

CVE-2024-58385 is a critical, unauthenticated SQL injection vulnerability (CWE-89) in the Yonyou U8 CRM fillbacksettingedit.php configuration endpoint, rated CVSS 9.8. The flaw is reachable without credentials because a DontCheckLogin=1 parameter explicitly disables the application's authentication check, after which the id parameter is passed into SQL queries without sanitization. Successful exploitation allows arbitrary SQL execution and, on Microsoft SQL Server deployments with xp_cmdshell enabled, arbitrary operating system command execution and backdoor file write-back. Exploitation activity was first observed in the wild by the Shadowserver Foundation on 2025-02-13; no patch, public PoC, or CISA KEV listing currently exists.

Technical Analysis

The vulnerable component is a web-accessible PHP endpoint named fillbacksettingedit.php, part of the Yonyou U8 CRM product. Two distinct weaknesses combine here:

1. Authentication bypass via parameter. The endpoint honors a parameter named DontCheckLogin. When supplied with the value 1, the application's login/session verification is skipped entirely. This is a logic flaw: an authentication decision is made based on a client-controlled request value rather than a server-side session state. The result is that the endpoint becomes reachable by any unauthenticated network client.

2. SQL injection via the id parameter. Once the request reaches the endpoint's database logic, the value of the id parameter is incorporated into SQL queries without sanitization or parameterization, violating CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Because the input is not escaped or bound, an attacker can append or reshape SQL statements to read, modify, or delete database contents, and — where the underlying database engine permits it — escalate to command execution.

The escalation path documented in the NVD description is specific to Microsoft SQL Server deployments: when the xp_cmdshell extended stored procedure is enabled, an attacker who controls the SQL context can invoke it to run arbitrary operating system commands under the SQL Server service account and to write backdoor files to disk. This converts a data-confidentiality/integrity bug into full host compromise (CVSS Confidentiality/Integrity/Availability all High). On deployments where xp_cmdshell is disabled, the impact is bounded to database-level read/write and potential lateral movement via the DBMS, but the injection itself remains fully unauthenticated and trivially reachable.

The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) confirms the exploitation economics: network-reachable, low complexity, no privileges required, no user interaction. The only mitigating variable is environmental — whether xp_cmdshell is enabled on the target SQL Server instance.

Note on scope: No affected version range, patch level, or specific build number is available from the tracked data. Organizations must inventory their Yonyou U8 CRM deployments directly; the presence of the fillbacksettingedit.php file in the web root is the determinative indicator.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker scans for internet-exposed Yonyou U8 CRM instances and probes for the fillbacksettingedit.php endpoint. Shadowserver telemetry collected from 2025-02-13 indicates active scanning/exploitation in the wild, so exposed instances are being enumerated at scale. Targeted reconnaissance may also match on the presence of the DontCheckLogin parameter handling or the U8 CRM page title.

2. Authentication bypass. The attacker issues a request to the endpoint with DontCheckLogin=1. Because the application defers its login check to this client-supplied value, the request is processed without a valid session. No credentials, tokens, or prior interaction are required.

3. Injection trigger. With authentication neutralized, the attacker supplies a crafted value in the id parameter. Because that value flows into a SQL query without sanitization, standard SQL injection techniques — boolean-based, error-based, UNION-based, or stacked queries depending on the driver — can be used to retrieve or manipulate data.

4. Post-exploitation. Against Microsoft SQL Server backends, the attacker can attempt to invoke xp_cmdshell (if enabled) to execute arbitrary OS commands under the database service account, write backdoor files to disk, and establish persistence. From there, the attacker can move laterally within the network reachable by the CRM host. Where xp_cmdshell is disabled, the attacker retains arbitrary database access — harvesting CRM data (customer records, credentials, business logic state) and potentially modifying application data.

Operational caveat: Because no exploit code or template is publicly tracked, defenders should treat any request to fillbacksettingedit.php carrying SQL metacharacters or the DontCheckLogin=1 parameter as hostile, regardless of whether a known payload is present.

Impact Assessment

• CVSS 9.8 (Critical). Subscores: Confidentiality High, Integrity High, Availability High; Attack Vector Network; Attack Complexity Low; Privileges Required None; User Interaction None; Scope Unchanged.
• Confidentiality: Full database read access enables exfiltration of all CRM-held data — customer PII, contact records, internal pricing, and potentially stored credentials or API secrets.
• Integrity: Arbitrary SQL write capability allows data tampering, record deletion, and, where xp_cmdshell is available, arbitrary file write and OS-level command execution on the CRM host.
• Availability: Database destruction or OS-level commands can render the CRM and possibly the host inoperable.
• Blast radius: Internet-exposed Yonyou U8 CRM instances are the immediate target. Because the vulnerability grants unauthenticated database control, the blast radius extends to any system trusting the CRM database or reachable from the compromised host (lateral movement, credential reuse, trust relationships to internal ERP/CRM infrastructure). Yonyou U8 is widely deployed in Chinese enterprise environments, so the population of potentially exposed, unpatched systems is significant.
• Business impact: CRM data exfiltration carries regulatory exposure (customer data), competitive harm, and — via backdoor file write and OS command execution — the risk of full network compromise and ransomware staging. Because no patch exists, exposure is indefinite for organizations unable to isolate the endpoint.

Detection Guidance

Sigma Rule

title: Yonyou U8 CRM Unauthenticated SQL Injection via fillbacksettingedit.php
id: 8f3c1a92-4d7b-4c1e-9a2f-6b5e0d3f7c21
status: experimental
description: Detects unauthenticated requests to Yonyou U8 CRM fillbacksettingedit.php abusing DontCheckLogin=1 and SQL metacharacters in the id parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-58385
author: valtersit.com
date: 2025-02-13
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/fillbacksettingedit.php'
  selection_authbypass:
    cs-uri-query|contains: 'DontCheckLogin=1'
  selection_sqli:
    cs-uri-query|contains:
      - "'"
      - '--'
      - 'union'
      - 'select'
      - 'xp_cmdshell'
      - 'waitfor'
      - ';--'
  condition: selection_endpoint and (selection_authbypass or selection_sqli)
falsepositives:
  - Authorized security testing
level: critical

YARA Rule

rule CVE_2024_58385_Yonyou_U8_CRM_SQLi_Request
{
    meta:
        description = "Detects HTTP requests targeting Yonyou U8 CRM fillbacksettingedit.php with auth-bypass and SQL injection indicators (CVE-2024-58385)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-58385"
        date = "2025-02-13"
        severity = "critical"

    strings:
        $ep = "fillbacksettingedit.php" ascii wide nocase
        $bypass = "DontCheckLogin=1" ascii wide nocase
        $id = "id=" ascii wide nocase
        $sqli1 = "union" ascii wide nocase
        $sqli2 = "select" ascii wide nocase
        $sqli3 = "xp_cmdshell" ascii wide nocase
        $sqli4 = "'--" ascii wide nocase
        $sqli5 = "waitfor" ascii wide nocase

    condition:
        $ep and ($bypass or any of ($sqli*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-58385 Yonyou U8 CRM fillbacksettingedit.php Unauthenticated SQLi Attempt"; flow:established,to_server; http.uri; content:"/fillbacksettingedit.php"; http.uri; content:"DontCheckLogin=1"; http.uri; pcre:"/(union|select|xp_cmdshell|waitfor|%27|'|--)/i"; classtype:web-application-attack; reference:cve,2024-58385; reference:url,nvd.nist.gov/vuln/detail/CVE-2024-58385; sid:202458385; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.uri : "*fillbacksettingedit.php*" and
     http.request.uri : "*DontCheckLogin=1*"]
  [network where http.request.uri : "*fillbacksettingedit.php*" and
     (http.request.uri : "*(select*" or http.request.uri : "*union*" or
      http.request.uri : "*xp_cmdshell*" or http.request.uri : "*--*")]

Splunk SPL Query

index=web
| eval uri = lower(coalesce(uri, cs_uri_stem, url))
| where match(uri, "fillbacksettingedit\.php")
| eval query = lower(coalesce(uri_query, cs_uri_query, url))
| where match(query, "dontchecklogin=1") OR match(query, "(union|select|xp_cmdshell|waitfor|%27|--)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by dest, uri
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,yonyou_u8,">
  <rule id="100385" level="15">
    <decoded_as>web-accesslog</decoded_as>
    <url>/fillbacksettingedit.php</url>
    <regex status="PDU">DontCheckLogin=1|union|select|xp_cmdshell|waitfor|--</regex>
    <description>CVE-2024-58385: Unauthenticated SQL injection attempt against Yonyou U8 CRM fillbacksettingedit.php</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no OSV package mapping, no upstream patch evidence exists in any tracked source. The following guidance is operational, not remedial; it reduces exposure but does not eliminate the vulnerability.

1. Immediate mitigations

• Block the endpoint at the edge. If fillbacksettingedit.php is not required for production workflows, block or return 403 for requests to /fillbacksettingedit.php at the reverse proxy, WAF, or load balancer. If it is required, restrict access to authenticated internal networks only.
• Block DontCheckLogin=1. Deploy a WAF rule rejecting any request to the CRM containing the DontCheckLogin parameter. This neutralizes the authentication bypass even if the underlying endpoint remains reachable.
• Disable xp_cmdshell. On Microsoft SQL Server instances backing the CRM, disable xp_cmdshell (EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;). This caps the worst-case impact by removing the OS command execution escalation path, though data-level SQL injection remains possible.
• Remove public internet exposure. Restrict U8 CRM instances behind VPN or zero-trust access controls. Shadowserver scanning since 2025-02-13 confirms active internet enumeration.

2. Patch/upgrade steps

• There is no patch. Monitor the Yonyou U8 CRM vendor advisories and the NVD entry for CVE-2024-58385 for a fixed release; upgrade immediately when one is published.
• Until then, treat all exposed instances as potentially compromised — assume database read/write and, if xp_cmdshell was enabled, host-level compromise. A compromise assessment is warranted on any instance that received hostile traffic.

3. Long-term hardening

• Enforce parameterized queries / prepared statements in all application database access so that client input never reaches SQL text as concatenated literals.
• Remove authentication logic that keys on client-supplied parameters; all authentication decisions must derive from server-side session state.
• Enforce least privilege on the CRM database account — no sysadmin role for the application user, which prevents xp_cmdshell invocation even if SQL injection recurs.
• Deploy WAF virtual patching and web access logging with alerting (rules above) as a standing control for web-facing CRM/ERP applications.
• Maintain an inventory of internet-exposed business applications and review it against vendor advisories on an ongoing basis.

References

1. NVD — CVE-2024-58385: https://nvd.nist.gov/vuln/detail/CVE-2024-58385
2. CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
3. Shadowserver Foundation — https://www.shadowserver.org/ (exploitation evidence first observed 2025-02-13; see Shadowserver reporting for subsequent telemetry)
4. Microsoft — xp_cmdshell configuration (Microsoft SQL Server): https://learn.microsoft.com/en-us/sql/relational-databases/security/ (see server configuration options)
5. CISA KEV Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2024-58385 is not currently listed; monitor for addition given observed in-the-wild activity)

Exploit-in-the-wild status: Shadowserver Foundation observed exploitation evidence on 2025-02-13. No named threat actor campaign is publicly attributed in the available data. No public PoC, Nuclei template, or exploit code is tracked at the time of writing.