EUVD-2026-83439Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
Network endpoint but requires MODULE_SETTING:UPDATE privilege (PR:H) and slow blind time-based inference (AC:H); no user interaction (UI:N, correcting vendor UI:R); confidentiality-primary with minor availability delays.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.
AnalysisAI
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_SETTING:UPDATE permission to inject SQL into the ORDER BY clause via the sort.name field of the POST /account-pool/page endpoint, enabling inference of database metadata and sensitive values through induced delays and causing service degradation. Exploitation requires a privileged, trusted account and the blind nature of the flaw makes data extraction slow, so this is a genuine but modest-priority issue rather than a mass-exploitable one. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated CordysCRM account holding the MODULE_SETTING:UPDATE permission (a privileged, trusted role), targeting the POST /account-pool/page endpoint on versions prior to 1.7.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but modest-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade CordysCRM to version 1.7.0 or later, which contains the fix shipped through pull request 2418 and commit b5b9272c016550d80a789fd8ffbf3d5a4c4bab52 (release: https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0; advisory: https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker wh
Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable call
CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerc
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to m
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to i
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAG
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPD
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today