Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-76899— CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

Quick assessment

Affected
1Panel-dev CordysCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CordysCRM 是一个支持私有化部署的开源 AI 驱动客户关系管理系统。在 1.7.0 至 1.7.4 版本中，拥有 MODULE_SETTING_UPDATE 权限的已认证用户可以利用 POST /account-pool/page 接口，在 SortRequest.name 参数中注入任意数据库函数。其原因是 CustomerPoolController.page 方法遗漏了 Spring 请求验证，SortRequest.getName 所依赖的黑名单不完整，且 CommonMapper.xml 中的排序

CVSS 5.7 · Medium

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76899

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
Source: CVE Program / CVE List V5
Vulnerability Description
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
1Panel-dev CordysCRM < 1.7.4 -

II. Public POCs for CVE-2026-76899

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76899

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76899 (3)

Other References for CVE-2026-76899 (2)

Same Patch Batch · 1Panel-dev · 2026-09-18 · 7 CVEs total

CVE-2026-63647 9.3 CRITICAL CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
CVE-2026-63646 6.9 MEDIUM CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
CVE-2026-76900 6.8 MEDIUM CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runt
CVE-2026-76901 5.8 MEDIUM CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoint
CVE-2026-52745 5.3 MEDIUM CordysCRM: Customer Public Pool Sorting Field SQL Injection
CVE-2026-76902 5.0 MEDIUM CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/

IV. Related Vulnerabilities

Same product: CordysCRM
Same vendor: 1Panel-dev
Same weakness: CWE-89

V. Comments for CVE-2026-76899

No comments yet

Leave a comment