Cordyscrm
Monthly
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to inject malicious scripts via the unvalidated Description parameter in the ModuleFormController's Save function. The payload persists to the database and executes in any victim's browser upon viewing the affected module form, enabling session hijacking, credential theft, or UI-based phishing. A publicly available proof-of-concept exists (GitHub issue #2233); no public exploitation at scale has been confirmed, and an official vendor patch is available as of v1.7.0.
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to inject malicious scripts via the unvalidated Description parameter in the ModuleFormController's Save function. The payload persists to the database and executes in any victim's browser upon viewing the affected module form, enabling session hijacking, credential theft, or UI-based phishing. A publicly available proof-of-concept exists (GitHub issue #2233); no public exploitation at scale has been confirmed, and an official vendor patch is available as of v1.7.0.