Is PHP affected by CVE-2026-38528?

Krayin CRM 2.2.x contains a SQL injection vulnerability in lead management that allows authenticated users with low-privilege credentials to extract sensitive database contents, potentially exposing customer information and business intelligence stored in the CRM.

CVE-2026-38528

EUVD-2026-22299 HIGH

2026-04-14 mitre

GHSA-hjjv-j557-q7r3

PHP SQLi

7.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 17:01 vuln.today

DescriptionNVD

Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.

AnalysisAI

SQL injection in Krayin CRM 2.2.x allows authenticated remote attackers to extract sensitive database contents via the rotten_lead parameter in LeadDataGrid.php. CVSS 7.1 severity with network attack vector and low complexity enables database enumeration with low-privilege credentials. …

RemediationAI

Within 24 hours: Inventory all instances of Krayin CRM 2.2.x in your environment and restrict database query logging to detect exploitation attempts via the rotten_lead parameter in LeadDataGrid.php. Within 7 days: Limit CRM access to essential users only, enforce strong password policies for CRM accounts, and review database access logs for suspicious queries. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-38528 vulnerability details – vuln.today

Back