This vulnerability exists in the getSqlBotSrc function of the IntegrationConfigService component in 1Panel-dev CordysCRM up to versions 1.4.0 and 1.4.1. By manipulating the appSecret parameter, an attacker can cause the server to make unauthorized requests to internal or external systems, resulting in server-side request forgery. The vulnerability is remotely exploitable and has been publicly disclosed. No official remediation or patch has been documented as of the publication date.

Successful exploitation allows an attacker to induce the vulnerable server to send crafted requests to arbitrary destinations. This can lead to unauthorized internal network scanning, data exfiltration, or interaction with internal services not normally accessible externally. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to the appSecret parameter. Avoid exposing the affected versions (1.4.0 and 1.4.1) to untrusted networks where possible.