Krayin CRM v2.2.x contains a SQL injection flaw in the rotten_lead parameter of the LeadDataGrid.php file. By injecting malicious SQL through this parameter, an attacker can read sensitive data, modify database entries, or potentially elevate privileges. The weakness aligns with the classic injection issue identified as CWE-89.

All installations running Krayin CRM version 2.2.x are affected. The vulnerability is present in the web application component that processes the rotten_lead input when rendering leads data.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted HTTP request to /Lead/LeadDataGrid.php with a malicious rotten_lead payload. No explicit authentication requirement is stated, so it may be exploitable from an unauthorized web request or from an authenticated session depending on other access controls implemented by the application.