CVE-2025-9140 | Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7 tabdetail_moduleSave.php getvaluestring sql injection

A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7 and classified as critical. Affected by this issue is some unknown functionality of the file /crm/crmapi/erp/tabdetail_moduleSave.php. The manipulation of the argument getvaluestring leads to sql injection.

This vulnerability is traded as CVE-2025-9140. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The affected component should be upgraded.

The vendor explains: “All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+.”