Executive brief
CordysCRM is an open-source AI-powered customer relationship management system used for managing business customer data. A flaw in the account pool sorting feature allows authenticated users with specific permissions to inject malicious SQL code through the sort field, potentially exposing sensitive database information or degrading system performance through time-based delays.
Technical details
The POST /account-pool/page endpoint in CordysCRM prior to 1.7.0 fails to properly validate the sort.name parameter before incorporating it into a dynamic SQL ORDER BY clause, enabling time-based blind SQL injection. An authenticated attacker with MODULE_SETTING:UPDATE permission can exploit this to infer database metadata, extract sensitive values, and introduce performance degradation. The vulnerability is remediated in version 1.7.0 through enhanced SQL injection protection.
Affected products
- 1Panel-dev CordysCRM before 1.7.0
Timeline
- 2026-09-18: disclosed
- 2026-05-26: patched: Fix released in version 1.7.0