Krayin CRM CVE-2026-41453

Exploitation requires a valid Krayin CRM user account with access to the leads module - this is a low-privilege role that any standard sales or CRM operator account would hold, not an administrative role. The rotten_lead[in] parameter is reachable through normal leads DataGrid interaction, so no non-default configuration or feature flag is necessary beyond having leads access. Exploitation is network-based against any internet- or intranet-exposed CRM instance. Limiting factors include: authentication is mandatory (unauthenticated exploitation is not possible per PR:L in the CVSS vector); blind injection is inherently slow and generates elevated database query load and access logs, increasing detectability; and write/delete capabilities are constrained by the HAVING-clause injection context, which typically precludes stacked queries under Laravel's PDO driver, meaning active data manipulation is not confirmed from available information.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and reflects network accessibility with no attack complexity and only low-privilege authentication required - a realistic threat model for any multi-user CRM deployment exposed to internal networks or the internet. The High confidentiality impact is well-supported by the description: full database read access via blind injection yields credentials, PII, and configuration secrets. The VI:H and VA:H ratings in the provided vector are somewhat generous for a HAVING-clause-only injection where stacked queries are typically blocked by PHP's PDO layer; write integrity impact is not independently confirmed from the description, and availability impact is primarily the slow DoS achievable via SLEEP() payloads. A public exploit writeup with documented technique exists, lowering the skill barrier significantly. No EPSS data was provided and no CISA KEV listing exists at time of analysis, suggesting exploitation has not yet been confirmed widespread; however, the combination of a documented public POC, a low-privilege requirement, and high-value data exposure (credential hashes) constitutes a genuinely elevated real-world risk, not just a high-CVSS-on-paper finding.

A publicly available writeup at https://jivasecurity.com/writeups/krayin-lead-datagrid-sqli-cve-2026-41453 documents the attack technique. An attacker with a standard CRM account that has leads access sends crafted HTTP requests to the leads DataGrid endpoint, appending SQL payloads to the rotten_lead[in] parameter - for example, injecting a conditional SLEEP() expression into the HAVING clause and measuring response timing to infer true/false conditions. Over hundreds of iterative requests, the attacker reconstructs the database schema, then methodically dumps tables containing user credential hashes, pipeline records, and application secrets without triggering application-level errors.