{"id":"CVE-2023-54403","published":"2026-09-30T21:16:52.150","lastModified":"2026-10-02T17:16:59.277","description":"Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20CRM%E5%AE%A2%E6%88%B7%E5%85%B3%E7%B3%BB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20getemaildata.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/yonyou/yonyou-u8-crm-lfi.yaml","tags":[]},{"url":"https://security.yonyou.com/#/noticeInfo?id=624","tags":[]},{"url":"https://www.vulncheck.com/advisories/yonyou-u8-crm-arbitrary-file-read-via-getemaildata-php","tags":[]},{"url":"https://www.yonyou.com/Global/","tags":[]}],"exploitRefs":[{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/oa/%E7%94%A8%E5%8F%8BOA/%E7%94%A8%E5%8F%8B%20U8%20CRM%E5%AE%A2%E6%88%B7%E5%85%B3%E7%B3%BB%E7%AE%A1%E7%90%86%E7%B3%BB%E7%BB%9F%20getemaildata.php%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md","tags":[]},{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/yonyou/yonyou-u8-crm-lfi.yaml","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows unauthenticated attackers to read arbitrary files on the server by manipulating the filePath parameter in /ajax/getemaildata.php, potentially exposing sensitive configuration files with database credentials and service details.","exploitability":"Easy to exploit with no prerequisites; attackers can directly access the vulnerable endpoint without authentication and read any file path they specify.","blast_radius":"Multiple systems could be affected across different organizations using Yonyou U8 CRM versions before V16.5 and V18, potentially exposing critical database credentials and application configuration files.","remediation":"Upgrade to Yonyou U8 CRM V16.5 or V18 to remediate this vulnerability.","detection":"Monitor for requests to /ajax/getemaildata.php with filePath parameter containing unusual path traversal sequences like '../' or '.../'; look for repeated access patterns to sensitive file paths such as /etc/passwd or application configuration files.","tags":["file-read","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:08:14.216Z"}}