CVE-2026-52745: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in 1Panel-dev CordysCRM
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.
AI Analysis
Technical Summary
CordysCRM, an open source AI-powered CRM system, has a SQL injection vulnerability (CWE-89) in versions before 1.7.0. The vulnerability exists in the POST /account-pool/page endpoint where an authenticated caller with MODULE_SETTING:UPDATE permission can supply a crafted sort.name parameter that is used directly in a dynamic SQL ORDER BY clause without strict server-side validation. This allows time-based blind SQL injection attacks that can confirm execution of database expressions, infer database metadata and sensitive information, and introduce delays that degrade service availability. The vulnerability is resolved in version 1.7.0.
Potential Impact
An attacker with authenticated access and MODULE_SETTING:UPDATE permission can exploit this vulnerability to perform time-based blind SQL injection. This enables confirmation of database expression execution, extraction of database metadata and sensitive values, and introduction of delays that degrade service availability. The CVSS 3.1 score is 5.3 (medium), reflecting high confidentiality impact, low integrity impact, and low availability impact with high attack complexity and required privileges.
Mitigation Recommendations
Upgrade CordysCRM to version 1.7.0 or later where this vulnerability is fixed. No other mitigation or workaround is provided in the advisory. Since this is not a cloud service, remediation depends on applying the official fix.
CVE-2026-52745: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in 1Panel-dev CordysCRM
Description
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.
CVSS v3.1
Score 5.3medium
Affected software
1Panel-dev
CordysCRM
pkg:github/1panel-dev/CordysCRMRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CordysCRM, an open source AI-powered CRM system, has a SQL injection vulnerability (CWE-89) in versions before 1.7.0. The vulnerability exists in the POST /account-pool/page endpoint where an authenticated caller with MODULE_SETTING:UPDATE permission can supply a crafted sort.name parameter that is used directly in a dynamic SQL ORDER BY clause without strict server-side validation. This allows time-based blind SQL injection attacks that can confirm execution of database expressions, infer database metadata and sensitive information, and introduce delays that degrade service availability. The vulnerability is resolved in version 1.7.0.
Potential Impact
An attacker with authenticated access and MODULE_SETTING:UPDATE permission can exploit this vulnerability to perform time-based blind SQL injection. This enables confirmation of database expression execution, extraction of database metadata and sensitive values, and introduction of delays that degrade service availability. The CVSS 3.1 score is 5.3 (medium), reflecting high confidentiality impact, low integrity impact, and low availability impact with high attack complexity and required privileges.
Mitigation Recommendations
Upgrade CordysCRM to version 1.7.0 or later where this vulnerability is fixed. No other mitigation or workaround is provided in the advisory. Since this is not a cloud service, remediation depends on applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T14:00:43.573Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad98c355bf5e2cf57b8892
Added to database: 09/18/2026, 20:02:11 UTC
Last enriched: 09/18/2026, 20:17:47 UTC
Last updated: 09/19/2026, 01:41:22 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.