Krayin CRM prior to version 2.2.4 contains a blind SQL injection flaw located in LeadDataGrid.php. The vulnerable rotten_lead[ in ] query parameter is concatenated directly into a HAVING clause via havingRaw(), bypassing parameterized binding. An attacker who is an authenticated user with access to leads can inject arbitrary SQL through time‑based or boolean‑based techniques, allowing full extraction of the database—including user credential hashes, CRM records, and configuration data. This results in a high‑severity confidentiality breach, potentially exposing sensitive organizational information.

The affected vendor is Krayin and the product is the laravel‑crm application. Versions of the application older than 2.2.4 are impacted; the release 2.2.4 contains the fix and all earlier releases are vulnerable.

With a CVSS score of 8.7 the vulnerability is classified as High. The EPSS score is not available, but the lack of an active exploit in commercial markets and absence from CISA KEV does not negate the risk; the flaw can be exploited by any authenticated lead‑manager using simple time‑based or boolean techniques. The political and technical barriers are minimal: the attacker only needs valid credentials and access to the leads section, and the injection can be carried out through ordinary HTTP requests without any special tooling.