Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary…

Krayin CRM versions prior to 2.2.4 contain a blind SQL injection vulnerability in the leads DataGrid component. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is concatenated without parameterized binding directly into a havingRaw() call. Authenticated users with leads access can exploit this vulnerability to inject arbitrary SQL into a HAVING clause. Attackers can leverage time-based and boolean-based blind injection techniques to extract sensitive data. Exploitable data includes user credential hashes, CRM records, and application configuration data. The vulnerability requires authentication but does not require administrative privileges. A patch has been released in version 2.2.4 of Krayin CRM. The fix is available via a commit on the official GitHub repository.