CyberRota Analysis
AI-GeneratedKrayin CRM versions prior to 2.2.4 are vulnerable to a blind SQL injection in the leads DataGrid, allowing authenticated users with leads access to execute arbitrary SQL queries through the manipulated rotten_lead[in] parameter. This vulnerability can lead to the extraction of sensitive data, including user credential hashes and application configuration. Organizations using Krayin CRM should prioritize patching this issue to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.