Executive brief
CordysCRM is an open-source AI-powered customer relationship management system. An authenticated attacker with module setting update permissions can inject arbitrary SQL functions into database queries through the sort parameter, allowing them to extract sensitive database values through error-based SQL injection techniques.
Technical details
SQL injection vulnerability in the POST /account-pool/page endpoint where the SortRequest.name parameter is inserted unsanitized into ORDER BY clauses via CommonMapper.xml. The vulnerability affects versions 1.7.0 through 1.7.3; an incomplete blacklist in SortRequest.getName() fails to block functions like extractvalue and updatexml that can be leveraged for error oracles to exfiltrate data when queries return rows. Authentication and MODULE_SETTING_UPDATE privilege are required.
Affected products
- 1Panel-dev CordysCRM 1.7.0 to 1.7.3
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 1.7.4