SQL Injection Vulnerability in Lingdang CRM Software
CVE-2024-11121

6.3MEDIUM

Key Information:

Vendor: 上海灵当信息科技有限公司
Status: Lingdang Crm
Vendor: CVE Published:; 12 November 2024

🔔 Create 上海灵当信息科技有限公司 Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2024-11121?

A critical SQL injection vulnerability has been identified in the Lingdang CRM software, specifically within the file located at /crm/WeiXinApp/marketing/index.php. This weakness allows for manipulation of the 'userid' parameter, which can be exploited by remote attackers to execute unauthorized SQL commands. The vulnerability affects all versions of Lingdang CRM up to 8.6.4.3 and poses a serious threat as it can lead to unauthorized access to sensitive data. Despite early notifications to the vendor regarding the issue, there has been no response. Organizations using vulnerable versions should prioritize applying patches or implementing workarounds to protect their applications from potential exploitation.

Affected Version(s)

Lingdang CRM 8.6.4.0

Lingdang CRM 8.6.4.1

Lingdang CRM 8.6.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-11121 - Proof of Concept