CVE-2025-70981
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker to manipulate the employee list query in CordysCRM, potentially gaining unauthorized access to sensitive data stored in the database. It requires the attacker to send specially crafted input through the departmentIds parameter in the user list interface.
Technical Description
CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 12, 2026
about 2 months ago
Last Modified
Feb 18, 2026
about 2 months ago
Vendor
fit2cloud
Product
cordys crm
Related Vulnerabilities
This vulnerability allows an attacker to bypass the security checks on cryptographic signatures in the SQLBot application, potentially allowing unauthorized access to sensitive data. However, exploiting this flaw requires a high level of skill and is considered complex, making it difficult for most attackers to take advantage of it.
This vulnerability allows an attacker to bypass access controls on the SQLBot API, potentially giving them unauthorized access to sensitive data or functions. The attack can be carried out remotely, so it's important to upgrade to version 1.5.0 to protect against this issue.