CVE-2025-8908

MEDIUM

Lingdang CRM < 8.6.5.4 - SQL Injection via openid Parameter in event.php

Title source: llm
STIX 2.1

Description

A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+."

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.319862
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.319862
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.626276

Scores

CVSS v3 6.3
EPSS 0.0031
EPSS Percentile 21.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
51mis/lingdang_crm < 8.6.5.4
Published Aug 13, 2025
Tracked Since Feb 18, 2026