CVE-2026-12260: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') in NetBoard CRM NetBoard CRM Demo Platform

This vulnerability is an SQL injection (CWE-89) in the NetBoard CRM Demo Platform, specifically affecting the 'user-name' POST parameter in the '/module/auth/recovery.php' endpoint. The injection is exploitable via blind SQL injection methods such as Boolean-based, error-based, time-based, and UNION-based techniques. Attackers can leverage this to extract sensitive information about the backend database and potentially alter data or escalate compromise within the CRM environment. The CVSS 4.0 base score is 10.0, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Exploitation can lead to unauthorized disclosure of sensitive backend information, unauthorized data modification, and potential full compromise of the CRM environment. The vulnerability allows remote attackers to execute arbitrary SQL commands without authentication, severely impacting confidentiality, integrity, and availability of the system.

No patch or official fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to SQL injection attempts.