CordysCRM versions from 1.7.0 up to but not including 1.7.4 contain a SQL Injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE privileges can inject arbitrary database functions into the SortRequest.name parameter. The vulnerability arises because the CustomerPoolController.page method omits Spring request validation, SortRequest.getName uses an incomplete blacklist, and the CommonMapper.xml inserts the sort parameter directly into an ORDER BY clause. Functions like extractvalue and updatexml bypass the blacklist and can reveal database contents via error-based SQL injection. The vulnerability is resolved in version 1.7.4.

An attacker with authenticated access and MODULE_SETTING_UPDATE permission can exploit this vulnerability to execute arbitrary SQL functions in the database query's ORDER BY clause. This can lead to unauthorized disclosure of database information (confidentiality impact), partial modification of data (integrity impact), and potential denial of service (availability impact). The CVSS score of 5.7 reflects a medium severity with high confidentiality impact, low integrity impact, and low availability impact.

Upgrade CordysCRM to version 1.7.4 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Since this is not a cloud service, patching the software is required to remediate the issue.