Which versions of Krayin CRM are affected by EUVD-2026-52341?

Krayin CRM versions prior to 2.2.4 allow any employee with leads access to exfiltrate the complete customer database and authentication credentials, creating immediate insider threat and data breach…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-52341?

Yes, a public proof-of-concept exploit is available for EUVD-2026-52341. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-52341?

Within 24 hours: identify all Krayin CRM instances in production, staging, and development and determine their version numbers to locate vulnerable deployments pre-v2.2.4. Within 7 days: upgrade all vulnerable instances to v2.2.4 or later, prioritizing production systems with comprehensive testing before each deployment. Within 30 days: complete upgrades across all environments, analyze database access logs from the past 90 days for evidence of exploitation, reset authentication credentials for employees with leads access, and implement database-level audit logging on all DataGrid queries to detect future abuse.

Krayin CRM EUVD-2026-52341

Q: What is the CVSS score of EUVD-2026-52341?

EUVD-2026-52341 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-41453 HIGH

SQL Injection (CWE-89)

2026-08-03 VulnCheck

GHSA-8879-fh4f-q3qm

PHP SQLi Laravel Crm Krayin

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network-exploitable with low privilege; C:H for full database read; I:N because HAVING-clause injection via PDO typically precludes stacked writes; A:L for SLEEP-based DoS only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 03, 2026 - 17:09 vuln.today

Analysis Generated

Aug 03, 2026 - 17:09 vuln.today

CVE Published

Aug 03, 2026 - 15:47 cve.org

HIGH 8.7

DescriptionCVE.org

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and boolean-based blind injection techniques to extract the entire database contents, including user credential hashes, CRM records, and application configuration data.

AnalysisAI

Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.

Technical ContextAI

Krayin CRM is an open-source PHP/Laravel CRM application (CPE: cpe:2.3:a:krayin:laravel-crm:*:*:*:*:*:*:*:*). Laravel's query builder exposes a havingRaw() method that accepts raw SQL fragments for HAVING clauses - a legitimate but dangerous API when user-supplied input is concatenated directly rather than passed as bound parameters. CWE-89 (SQL Injection) covers exactly this failure mode: the application trusts and interpolates attacker-controlled data into a SQL fragment, bypassing the parameterized-query protections that Laravel's Eloquent ORM would otherwise enforce. The specific injection point, the rotten_lead[in] query parameter used for filtering leads by 'rotten' status, is processed in LeadDataGrid.php and appended verbatim into the HAVING clause of the underlying query. Because HAVING operates post-aggregation on a SELECT, the injection is exploitable through time-based (SLEEP-based) and boolean-based blind techniques to enumerate schema structure and systematically extract arbitrary database rows without triggering overt errors.

RemediationAI

Upgrade Krayin CRM to version 2.2.4 or later immediately; the fix is confirmed in the official release at https://github.com/krayin/laravel-crm/releases/tag/v2.2.4 and the patch commit is documented at https://github.com/krayin/laravel-crm/commit/2a3724cb7e9e65ab98f2b42c8ca2c98dede48f62. If an immediate upgrade is operationally blocked, restrict access to the leads DataGrid to the minimum set of trusted, high-privilege users via CRM role configuration, reducing the number of principals who can reach the rotten_lead[in] parameter. A WAF rule blocking SQL keywords and function patterns (SLEEP, BENCHMARK, AND 1=, OR 1=) in query string parameters named rotten_lead can add a compensating layer but is not a substitute for patching since blind injection encodings can evade signature-based filters. Note that the v2.2.4 release also patches a stored XSS in the notes field (#2542) and an IDOR in agent record access control (#2567), making the upgrade additionally compelling from a holistic security posture.