Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-52745 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

CNA: [email protected]CVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52	[email protected]	Source CodeVendor
https://github.com/1Panel-dev/CordysCRM/pull/2418	[email protected]	Issue TrackingVendor
https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0	[email protected]	Release NotesVendor
https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j	[email protected]	AdvisoryRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]

Affected Products

Product	Versions
1Panel-dev CordysCRM	< 1.7.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.7.0moderate efforthttps://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0 Mitigation:low effort Restrict the MODULE_SETTING:UPDATE permission to trusted administrators only. Mitigation:low effort Add strict server-side allowlists for sort.name, allowing only known sortable fields such as name, create_time, and update_time. Mitigation:low effort Ensure sort.type only accepts asc or desc. Mitigation:low effort Avoid MyBatis ${} interpolation for user-controlled sorting fields. Mitigation:low effort Block suspicious sort.name values at WAF or reverse proxy level. Mitigation:low effort Monitor /account-pool/page requests containing SQL functions such as sleep, benchmark, database, substr, ascii, or if.

Product

Versions

1Panel-dev CordysCRM

< 1.7.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 1.7.0moderate efforthttps://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0
Mitigation:low effort
Restrict the MODULE_SETTING:UPDATE permission to trusted administrators only.
Mitigation:low effort
Add strict server-side allowlists for sort.name, allowing only known sortable fields such as name, create_time, and update_time.
Mitigation:low effort
Ensure sort.type only accepts asc or desc.
Mitigation:low effort
Avoid MyBatis ${} interpolation for user-controlled sorting fields.
Mitigation:low effort
Block suspicious sort.name values at WAF or reverse proxy level.
Mitigation:low effort
Monitor /account-pool/page requests containing SQL functions such as sleep, benchmark, database, substr, ascii, or if.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 19, 2026	CVE Modified	CISA-ADP
Sep 18, 2026	New CVE Received	[email protected]