Executive brief
Ultimate Project Manager CRM PRO, a business management platform used for tracking projects, clients, and human resources, contains a security flaw in its search functionality. An attacker can exploit this to secretly extract sensitive information from the system's database, including administrative usernames and encrypted password hashes. This could lead to full account takeover, unauthorized access to corporate financial data, and exposure of client information.
Technical details
A blind SQL injection vulnerability exists in the 'search' parameter of the /frontend/get_article_suggestion/ endpoint in Ultimate Project Manager CRM PRO version 2.0.5 and earlier. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, allowing for boolean-based inference attacks. By sending crafted POST requests, an unauthenticated remote attacker can determine the contents of the 'tbl_users' table character by character. This allows for the extraction of sensitive credentials, specifically usernames and password hashes. While the vulnerability does not support UNION-based payloads, automated scripts can be used to efficiently leak the entire user database.
Affected products
- Codexcube Ultimate Project Manager CRM PRO <= 2.0.5
Timeline
- 2020-10-20: disclosed: Exploit published on Exploit-DB
- 2026-01-29: advisory: CVE published/updated via VulnCheck/NVD