CVE-2026-41453
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.
Risk Assessment
An attacker can extract the entire database contents, including user password hashes and sensitive CRM data, potentially leading to full system compromise.
Recommendation
Update Krayin CRM to version 2.2.4 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Krayin CRM
See all- CVE-2026-41452Critical
Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware, allowing unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.
- CVE-2026-61460High
Krayin CRM up to version 2.2.3 contains an insecure direct object reference (IDOR) vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. It allows authenticated users to edit, update, or delete records owned by other users.
- CVE-2024-45932Medium
Krayin CRM version 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2. An attacker can inject malicious JavaScript code that will execute in the administrator's browser.
Original NVD description (English source)
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.