CVE-2026-52745: CordysCRM: Customer Public Pool Sorting Field SQL Injection
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CordysCRMto a version that resolves this vulnerability.Fixed in 1.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and hold the MODULE_SETTING:UPDATE permission. Exploitation also requires sending a crafted request to the POST /account-pool/page endpoint and user interaction is required according to the supplied severity vector.
Which deployments are affected?
CordysCRM versions prior to 1.7.0 are affected. The provided information does not state whether the required permission is assigned in a default deployment.
What is the practical impact of successful exploitation?
A successful attacker can use time-based blind SQL injection to confirm database expression execution and infer database metadata and sensitive values. Crafted expressions can also cause database delays that degrade service.
What should teams do if they cannot patch immediately?
Restrict MODULE_SETTING:UPDATE to only trusted administrators and monitor or limit access to the POST /account-pool/page endpoint where possible. These measures reduce exposure because the vulnerable input is the sort.name field submitted to that endpoint.
How can defenders identify attempted exploitation?
Review requests to POST /account-pool/page for unusual or crafted sort.name values and correlate them with abnormal database query delays. The issue is specifically triggered when sort.name is incorporated into a dynamic SQL ORDER BY expression.