Description
灵当CRM系统（版本8.6.4.7及更高版本）中发现一个严重漏洞。该漏洞影响文件crm/WeiXinApp/yunzhijia/yunzhijiaApi.php中的delete_user函数。该函数参数的操作会导致SQL注入。该攻击可通过远程方式发起。该漏洞已公开，可能被利用。
灵当CRM yunzhijiaApi.php 存在SQL注入漏洞（CVE-2025-8345）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://ddpoc.com/DVB-2025-9829.html
https://cve.imfht.com/detail/CVE-2025-8345
https://www.wlaqsys.com/archives/12528
https://blog.csdn.net/weixin_65311462/article/details/142532387
https://nvd.nist.gov/vuln/detail/CVE-2025-8345
https://github.com/advisories/GHSA-4692-rqch-8m26
https://vuldb.com/?id.318295
https://www.cvedetails.com/cve/CVE-2025-8345/
https://radar.offseq.com/threat/cve-2025-8345-sql-injection-in-shanghai-lingdang-i-0c52a08d
https://dbugs.ptsecurity.com/vulnerability/PT-2025-31468