CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 1Panel-dev | CordysCRM | before 1.7.4 | 1.7.4 | Patch available | CNA |
- CordysCRM Vendor1Panel-dev Affected before 1.7.4 Fixed in 1.7.4 Patch available CNA
Remediation
- Fix · CNA CordysCRM (1Panel-dev) Fixed in 1.7.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76899
References
Other 5
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-x6p7-vhgp-6r3q
- https://github.com/1Panel-dev/CordysCRM/pull/2975
- https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8
- https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5
- https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4
More 1Panel-dev vulnerabilities
- TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
- TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
- TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
- TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
- TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
- TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences