BossSoft CRM CVE-2025-7801

Q: What is the CVSS score of CVE-2025-7801?

CVE-2025-7801 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-18 cna@vuldb.com

SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote unauthenticated attack, low impact per description and CVSS 4.0 metrics.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:18 vuln.today

DescriptionCVE.org

A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/module/HNDCBas_customPrmSearchDtl.jsp. The manipulation of the argument cstid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in BossSoft CRM 6.0 allows remote unauthenticated attackers to extract or modify database content through the cstid parameter in the HNDCBas_customPrmSearchDtl.jsp file. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is low (0.04%), suggesting limited real-world targeting.

Technical ContextAI

The vulnerability is an SQL injection (CWE-74) affecting the BossSoft CRM 6.0 web application. The injection occurs in the cstid parameter of the HNDCBas_customPrmSearchDtl.jsp page, which is likely used for custom price search functionality. Insufficient input validation allows an attacker to inject arbitrary SQL commands into database queries. The CPE for the product is not provided, but the affected software is BossSoft CRM 6.0, a niche customer relationship management solution.

Affected ProductsAI

BossSoft CRM 6.0 is affected. The specific vulnerable file is /crm/module/HNDCBas_customPrmSearchDtl.jsp, and the vulnerable parameter is cstid. No version range beyond 6.0 is specified. References include the VulDB entry (https://vuldb.com/?id.316867) and a public exploit disclosure (https://github.com/cc2024k/CVE/issues/1).

RemediationAI

No official vendor patch has been identified at the time of analysis. As a workaround, implement strict input validation and parameterized queries for the cstid parameter. Deploy a web application firewall (WAF) with rules to block SQL injection patterns. If possible, remove or restrict access to the HNDCBas_customPrmSearchDtl.jsp page. Note that blocking the page may impact legitimate business functionality; testing in a staging environment is recommended before production deployment.