CVE-2026-52745 in CordysCRM
Summary
by MITRE • 09/18/2026
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in CordysCRM prior to version 1.7.0 represents a classic instance of SQL injection within an authenticated context, specifically targeting the dynamic query construction mechanisms used for data sorting operations. The system functions as an open-source customer relationship management platform with private deployment capabilities, relying on backend database interactions to manage and display account pool information. In versions preceding the patch, the POST /account-pool/page endpoint accepts a sort.name parameter which is directly concatenated into SQL ORDER BY clauses without adequate sanitization or validation against a whitelist of permissible column names. This architectural flaw allows an authenticated user possessing MODULE_SETTING:UPDATE privileges to inject malicious payloads that alter the execution logic of database queries rather than merely manipulating data values, thereby escalating the severity from simple data exfiltration to potential full system compromise depending on database permissions and configuration.
From a technical perspective, this vulnerability is categorized under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly referred to as SQL Injection. The specific manifestation here involves time-based blind injection techniques. Because the injected payload affects the ORDER BY clause rather than a WHERE condition or data insertion point, traditional error-based extraction methods may not apply directly. Instead, attackers leverage functions such as SLEEP() or BENCHMARK() in MySQL environments to introduce deliberate delays into query execution times. By measuring these response time differentials, an attacker can systematically infer database metadata, including table names and column structures, and subsequently extract sensitive information bit by bit through boolean-based logic checks that trigger conditional delays. This method bypasses many standard input validation filters because the injection occurs in a context where string quoting rules differ from typical data entry fields, allowing raw SQL syntax to be interpreted as part of the query structure itself.
The operational impact of this vulnerability extends beyond immediate data theft to include significant service degradation and availability risks. The time-based nature of the attack means that each bit of extracted information requires multiple requests with varying delays, consuming substantial database resources and network bandwidth over extended periods. This can lead to resource exhaustion on the backend database server, causing latency spikes for legitimate users or complete unavailability of the CRM interface during active exploitation attempts. Furthermore, if the underlying database user has elevated privileges such as FILE access or EXECUTE permissions on stored procedures, the attacker could potentially write files to the operating system or execute arbitrary commands, leading to full host compromise. The requirement for MODULE_SETTING:UPDATE authentication limits the attack surface to insider threats or compromised accounts with administrative capabilities, but does not mitigate the severity of the resulting damage if such credentials are obtained through phishing, credential stuffing, or other lateral movement techniques within a breached network perimeter.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves upgrading CordysCRM to version 1.7.0 or later, where the developers have implemented proper validation for sorting fields. In addition to relying on vendor patches, organizations should enforce strict input validation by maintaining a whitelist of allowed column names that can be used in sort operations, rejecting any input not explicitly defined as safe. Parameterized queries are less effective here due to the structural nature of ORDER BY clauses, so dynamic SQL construction must use string replacement against validated identifiers rather than direct concatenation. Network-level controls such as Web Application Firewalls should be configured with rulesets tuned for blind SQL injection patterns, particularly those detecting time-based delays and unusual query structures in POST parameters. Furthermore, principle of least privilege dictates that the database user account used by CordysCRM should not possess administrative rights or file system access permissions, limiting the blast radius even if an injection succeeds.
This vulnerability aligns with MITRE ATT&CK technique T1059 Command and Scripting Interpreter via SQL commands, specifically focusing on data exfiltration through time-based blind techniques (T1078 Valid Accounts combined with T1113 Screen Capture or Data from Local System depending on final goals). The exploitation path demonstrates how authenticated access can be leveraged to bypass perimeter defenses when internal application logic fails to validate structural inputs. Security teams should prioritize patching this endpoint and review other dynamic query constructions within the CRM for similar weaknesses, ensuring that all user-supplied data influencing SQL syntax is strictly validated against known safe values before execution. Regular penetration testing focusing on authenticated injection vectors will help identify residual risks in complex enterprise applications where privilege escalation through database manipulation remains a critical threat vector.