CVE-2026-41453 is a blind SQL injection vulnerability affecting Krayin laravel-crm before version 2.2.4. The vulnerability exists because the rotten_lead[in] query parameter is directly concatenated into a havingRaw() SQL call in LeadDataGrid.php without proper parameterization or sanitization. This improper neutralization of special elements in SQL commands enables authenticated users with leads access to inject arbitrary SQL code into the HAVING clause. Exploitation techniques include time-based and boolean-based blind injection, potentially allowing attackers to extract the entire database contents, including sensitive user credentials and CRM data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information stored in the database, including user credential hashes, CRM records, and application configuration data. This compromises the confidentiality and integrity of the affected system's data. The vulnerability requires authenticated access with leads permissions but does not require user interaction or elevated privileges beyond that. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 2.2.4, upgrading to version 2.2.4 or later is recommended once an official fix is available. Until then, restrict leads access to trusted users only and monitor for suspicious activity related to the rotten_lead[in] parameter. Avoid using vulnerable versions in production environments.