Executive brief
Axelor, an open-source business management platform (ERP/CRM), contains a security flaw that allows unauthorized individuals to access its underlying database. By sending specially crafted requests, an attacker can bypass security controls to view, modify, or delete sensitive business data. This could result in a total loss of data confidentiality and integrity, potentially impacting financial records, customer information, and operational continuity.
Technical details
A Boolean-based SQL injection vulnerability exists in Axelor version 5.2.4 within the '_domain' parameter. The application fails to properly neutralize special elements used in SQL commands, allowing an attacker to manipulate query logic by injecting Boolean payloads (e.g., 'OR 1=1' vs 'OR 1=2'). By observing differential server responses based on these true/false conditions, a remote attacker can systematically exfiltrate the entire contents of the database. While the reproduction steps mention logging in, the provided CVSS 3.1 vector (PR:N) suggests the flaw may be exploitable without prior authentication depending on the specific endpoint configuration. Mitigation requires the implementation of parameterized queries or prepared statements to separate SQL logic from user-supplied input.
Affected products
- Axelor Axelor Open Suite 5.2.4
Timeline
- 2025-08-04: disclosed
- 2025-08-04: advisory