CVE-2026-76899: CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CordysCRMto a version that resolves this vulnerability.Fixed in 1.7.4
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and hold the MODULE_SETTING_UPDATE permission. They also need to send a request to the POST /account-pool/page endpoint.
What is required for data exposure through this issue?
The attacker can supply a database function through SortRequest.name. Error-based extraction using functions such as extractvalue or updatexml requires the affected query to return at least one row.
Which component should be updated?
Update CordysCRM to version 1.7.4, which contains the fix. The vulnerable behavior is associated with the account-pool page endpoint and its handling of the sort.name field.