EUVD-2026-60357
GHSA-jwww-rvpp-fjf3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CRM+ Appointments endpoint
-
DeliverySend crafted CheckConflictOfDates request
-
ExploitInject time-based blind SQL payload
-
ExecutionInfer data via response delays
-
PersistExtract DB contents or write web shell
-
ImpactAchieve code execution / data theft
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The specific prerequisite is network reachability of the CRM+ Appointments module's conflict-check endpoint - index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true - which per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication, no user interaction, and works against default configurations of CRM+ ≤ 2025.6. The practical limiting factor is exposure: exploitation requires the attacker to reach that endpoint, so instances behind VPN, IP allow-listing, or SSO/reverse-proxy authentication in front of the app are not directly reachable. Being time-based blind, exploitation is slower and noisier (many timed requests) than error-based SQLi, but this limits speed, not feasibility. |
| Impact | Signals are mostly aligned toward high priority but with one notable tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a trivially reachable, unauthenticated, network-exploitable flaw with total impact, and CISA SSVC corroborates this (Automatable:yes, Technical Impact:total, Exploitation:poc). However, EPSS is only 0.16% (6th percentile), which conflicts with the 'easy and automatable' picture - this most likely reflects the product's limited deployment footprint and the vulnerability's recency rather than any technical difficulty, meaning risk is real for any exposed CRM+ instance even if internet-wide mass exploitation has not been observed. Not in CISA KEV, so there is no confirmation of active exploitation; a POC exists, which is a distinct and lesser signal than in-the-wild abuse. Net: treat as a genuine high priority for organizations actually running CRM+, while recognizing the low EPSS suggests targeted/opportunistic rather than commodity exploitation so far. |
| Exploit ScenarioDerived | An attacker who can reach the CRM+ web interface sends a crafted HTTP request to the Appointments CheckConflictOfDates endpoint with a malicious parameter containing time-based blind SQL injection payloads, requiring no authentication or user interaction. By measuring response delays, they enumerate the database schema and exfiltrate credentials or customer data, and where database privileges allow, escalate to writing a web shell for arbitrary code execution. A public PoC referenced in the researcher's GitHub repository lowers the skill barrier for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
SQL injection in Brainformatik CRM+ through version 2025.6 allows remote unauthenticated attackers to inject arbitrary SQL via the appointment conflict-checking AJAX endpoint (index.php?module=Appointments&action=CheckConflictOfDates), enabling full database compromise. The flaw is time-based (blind) but scores CVSS 9.8 with total technical impact; a public proof-of-concept exists (CISA SSVC: exploitation=poc) though it is not yet in CISA KEV. EPSS is low (0.16%, 6th percentile), indicating no widespread automated exploitation observed to date despite the critical severity.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis, so the primary action is to contact Brainformatik (https://www.brainformatik.com/) for a fixed release beyond 2025.6 and upgrade as soon as one is published. Until then, apply specific compensating controls: block or tightly restrict access to the vulnerable endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true at a WAF or reverse proxy (side effect: may break legitimate calendar conflict-checking in the UI); deploy WAF rules to detect time-based SQLi patterns such as SLEEP/BENCHMARK and stacked queries on that parameter (side effect: possible false positives, and blind SQLi can be obfuscated to evade signatures); place the CRM+ application behind VPN/IP allow-listing to remove unauthenticated internet exposure (side effect: reduces convenience for remote/mobile users); and enforce least-privilege on the database account used by CRM+ (remove FILE privilege and OUTFILE capability to blunt the RCE path; side effect: none if the app does not legitimately need file export). Review the researcher advisory at https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2026-50769 for exploit specifics to tune detections.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CRM+ is a PHP-based commercial customer-relationship-management web application from German vendor Brainformatik. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable parameters passed to the Appointments module's CheckConflictOfDates action - which queries the calendar for scheduling conflicts - are concatenated into a SQL statement without parameterization or adequate sanitization. Because the injection manifests as time-based blind SQLi, the application returns no direct error or data, but an attacker infers results from response-timing differences driven by injected conditional delays (e.g. SLEEP()). The Tags flag PHP/SQLi/RCE, and the description references arbitrary code execution, which for MySQL-class backends can arise via stacked queries, INTO OUTFILE web-shell writes, or abuse of database features where privileges permit.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable endpoint with no user interaction (AV:N/AC:L/PR:N/UI:N); SQLi yields full database read/write and availability impact, so C:H/I:H/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is vulnerable to SQL injection allowing an attacker to execute arbitrary code.
Executive ViewAI
Brainformatik CRM+ versions through 2025.6 contain a critical unauthenticated SQL injection flaw in the appointment scheduling module that enables complete database compromise. No vendor-released patch identified at time of analysis, creating immediate risk to customer data integrity and organizational operations across all affected deployments.
Implement network segmentation to restrict external access to the vulnerable appointment conflict-checking endpoint; deploy WAF rules targeting time-based SQL injection signatures; enforce least-privilege database authentication with restricted query permissions on CRM+ service accounts; establish continuous monitoring and alerting for abnormal database activity; maintain validated, isolated backups to enable rapid recovery if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB