Executive brief
CRM+ is a customer relationship management platform used by businesses to manage sales, marketing, customer support, and billing processes. The application contains a time-based SQL injection vulnerability in the appointment scheduling feature that allows an authenticated attacker to extract or manipulate database contents, potentially exposing sensitive customer and business data or disrupting operations.
Technical details
The vulnerability is a time-based blind SQL injection in the CheckConflictOfDates endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true). The userId parameter is not properly sanitized before being included in a SQL query, allowing an attacker to inject arbitrary SQL code. The attack requires authentication (login to the application) and network access to the CRM+ instance. An attacker can use time-based techniques or automated tools like SQLMap to extract data from the underlying MySQL database. Versions 2025.6 and earlier are affected; patch availability from Brainformatik has not been confirmed in the advisory.
Affected products
- Brainformatik CRM+ 2025.6 and earlier
Timeline
- 2026-08-17: disclosed