CVE-2025-8219 is a medium severity (CVSS 6.3) SQL injection in Lingdang CRM up to version 8.6.4.7, from Shanghai Lingdang Information Technology. The record says upgrading to 8.6.5.2 addresses it. The weakness is in a POST request handler, and the vendor says the SQL injection vectors were fixed with parameterized queries.
What's affected
Lingdang CRM up to and including 8.6.4.7, per the record. The vulnerable file is /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php, part of the HTTP POST request handler, and the manipulated argument is getvaluestring.
The fixed version named in the record is 8.6.5.2. The vendor statement quoted in the record says that all SQL injection vectors were patched with parameterized queries and input sanitization in 8.6.5 and later, and advises customers to move to the current version, 8.6.5.2, which also carries other security enhancements.
Severity differs between the two statements in the record. The description text says VulDB rated the issue as critical, while the CVSS 3.1 score is 6.3, which is medium, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The vector shows a low privilege requirement, so an account may be needed. Treat the numeric score as the authoritative figure and plan for the worst case anyway, since a CRM holds customer data.
I could not retrieve the reporter write-up linked from the record, so affected and fixed versions come from the NVD record and the vendor quote in it. Confirm against the vendor's release notes before you schedule the upgrade.
How to check if you're exposed
Find your installed version from the product's admin or about screen, or from the version file in your deployment. Anything at 8.6.4.7 or lower is in scope.
Then look for requests to the vulnerable path in your web server logs. Adjust the log path for your server.
grep "tabdetail_moduleSave_dxkp.php" /var/log/nginx/access.log | tail -n 50
Requests from addresses outside your own staff or integrations deserve a closer look, as do unusually long values in the getvaluestring field. The endpoint sits under an API path, so also check whether it is reachable from the internet at all.
What to do now
- Record the version of every Lingdang CRM instance you run.
- Upgrade to 8.6.5.2 or later, following the vendor's upgrade guide, and take a backup first.
- Until then, restrict the CRM and its API paths to your office or VPN addresses.
- Review the logs for the vulnerable path since the product was exposed.
- Check the CRM database for records that were changed or exported unexpectedly.
Why it matters
The weakness is CWE-89 (SQL Injection), under CWE-74 (Injection). A value from the request is combined with SQL text, so the database may read part of the value as a command. The vendor fix is the standard one: parameterized queries, where the value is bound separately and never parsed as SQL.
A CRM concentrates contact lists, deal notes and sometimes credentials for integrations, which makes any injection flaw in it worth acting on even at a medium score. The record does not flag this CVE as CISA KEV, and it does not claim exploitation in the wild.
Try it yourself
This demo shows how a fixed version is matched to an affected component so the upgrade is the first thing you see.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-8219?
The record names 8.6.5.2 as the version that addresses the issue, and the vendor statement says the SQL injection vectors were patched from 8.6.5 onward. Confirm in the vendor release notes.
Is this critical or medium?
Both appear in the record. VulDB called it critical in the description, and the CVSS 3.1 base score is 6.3, which is medium. Use the score for tracking and treat the data held in your CRM as the real stakes.
Sources
- CVE-2025-8219 on Safeguard Gold
- NVD record and vendor statement for CVE-2025-8219, published 2025-07-27
Last reviewed: 18 October 2026.
