CVE-2026-12260: SQL injection in the NetBoard CRM demo platform
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable with no privileges or user interaction required. The affected input is the user-name POST parameter at the /module/auth/recovery.php endpoint.
What types of SQL injection techniques are reported to work?
The vulnerable parameter supports blind Boolean-based, error-based, time-based, and UNION-based SQL injection techniques. This may allow attackers to extract backend details and other confidential information.
What could an attacker do after successful exploitation?
Successful exploitation may allow an attacker to extract confidential information, alter data, or further compromise the CRM environment.