{"id":"CVE-2025-0462","state":"PUBLISHED","title":"Shanghai Lingdang Information Technology Lingdang CRM index.php sql injection","description":"A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-01-14T16:31:05.486Z","updatedAt":"2025-01-14T16:53:00.271Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","source":"VulDB"},"assigner":"VulDB","products":["Shanghai Lingdang Information Technology Lingdang CRM"],"affected":[{"vendor":"Shanghai Lingdang Information Technology","product":"Lingdang CRM","versions":[{"version":"8.6.0","status":"affected"}]}],"references":["https://vuldb.com/?id.291479","https://vuldb.com/?ctiid.291479","https://vuldb.com/?submit.474254","https://github.com/BxYQ/ld/blob/main/ListView_SQL.doc"],"weaknesses":["CWE-89","CWE-74"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/0xxx/CVE-2025-0462.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-0462","state":"PUBLISHED","datePublished":"2025-01-14T16:31:05.486Z","dateUpdated":"2025-01-14T16:53:00.271Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-01-14T08:17:44.354Z"},"containers":{"cna":{"title":"Shanghai Lingdang Information Technology Lingdang CRM index.php sql injection","descriptions":[{"lang":"en","value":"A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine kritische Schwachstelle wurde in Shanghai Lingdang Information Technology Lingdang CRM bis 8.6.0.0 gefunden. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. Dank Manipulation des Arguments searchcontent mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Shanghai Lingdang Information Technology","product":"Lingdang CRM","versions":[{"version":"8.6.0","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.291479","name":"VDB-291479 | Shanghai Lingdang Information Technology Lingdang CRM index.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.291479","name":"VDB-291479 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.474254","name":"Submit #474254 | Shanghai Lingdang Information Technology Co., Ltd. Lingdang CRM  <=V8.6.0.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/BxYQ/ld/blob/main/ListView_SQL.doc","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","type":"CWE","lang":"en","description":"SQL Injection"}]},{"descriptions":[{"cweId":"CWE-74","type":"CWE","lang":"en","description":"Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-01-14T16:31:05.486Z"},"timeline":[{"time":"2025-01-14T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-01-14T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-01-14T09:22:51.000Z","lang":"en","value":"VulDB entry last update"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-14T16:52:56.830961Z","id":"CVE-2025-0462","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-14T16:53:00.271Z"}}]}}}