CVE-2025-70981: Fit2cloud Cordys CRM SQLi Vulnerability

CVE-2025-70981 Overview

CVE-2025-70981 is a SQL injection vulnerability affecting Fit2cloud CordysCRM version 1.4.1. The flaw resides in the employee list query interface at /user/list and is triggered through the departmentIds parameter. Unauthenticated attackers can inject arbitrary SQL statements over the network without user interaction. Successful exploitation enables disclosure of database contents, modification of records, and potential compromise of the underlying data store. The vulnerability is classified under CWE-89 for improper neutralization of special elements used in an SQL command.

Critical Impact
Remote, unauthenticated attackers can execute arbitrary SQL queries against the CordysCRM database, leading to full confidentiality, integrity, and availability loss.

Affected Products

Fit2cloud CordysCRM 1.4.1
Deployments exposing the /user/list endpoint to untrusted networks
Installations using the departmentIds query parameter without server-side validation

Discovery Timeline

2026-02-12 - CVE-2025-70981 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-70981

Vulnerability Analysis

The vulnerability stems from the CordysCRM employee list query interface accepting untrusted input in the departmentIds parameter and concatenating that input directly into a backend SQL statement. The /user/list endpoint does not perform parameterized queries or enforce input validation on department identifiers. Attackers can supply crafted payloads containing SQL syntax that the database server then executes as part of the original query. Because the endpoint is reachable without authentication, exploitation requires no prior access to the application. The CWE-89 classification confirms the root cause as improper neutralization of SQL special elements.

Root Cause

The departmentIds parameter is interpolated into a dynamically constructed SQL query without sanitization, escaping, or use of prepared statements. CordysCRM treats the parameter as a trusted list of identifiers but performs no type checking before passing the value to the database driver. This violates secure coding practices for SQL query construction outlined in CWE-89.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to /user/list with a malicious payload appended to the departmentIds parameter. The injected SQL alters the original query logic, enabling UNION-based extraction, boolean-based blind inference, or time-based blind inference against the backend database. A public proof-of-concept describing the request structure and payload format is published at the GitHub SQL Injection PoC Repository. No exploitation code is reproduced here; refer to the linked advisory for full technical details.

Detection Methods for CVE-2025-70981

Indicators of Compromise

HTTP requests to /user/list containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP, or comment sequences (--, /*) in the departmentIds parameter
Unusual database query latency or errors originating from the CordysCRM application user
Outbound database connections or large result sets returned from the employee list endpoint

Detection Strategies

Inspect web server and application logs for malformed or oversized departmentIds values targeting /user/list
Deploy a web application firewall (WAF) signature for SQL injection patterns scoped to CordysCRM URI paths
Correlate authentication-less requests to /user/list with subsequent database error messages or anomalous query plans

Monitoring Recommendations

Enable database audit logging for queries executed by the CordysCRM service account
Alert on requests to /user/list from external IP ranges or non-trusted networks
Baseline normal request volume to the employee list endpoint and trigger on statistical deviation

How to Mitigate CVE-2025-70981

Immediate Actions Required

Restrict network access to the CordysCRM /user/list endpoint using firewall rules or reverse proxy ACLs until a vendor patch is available
Deploy WAF rules that block SQL syntax in the departmentIds parameter
Audit database logs for evidence of prior exploitation attempts
Rotate database credentials used by the CordysCRM application if compromise is suspected

Patch Information

At the time of publication, no vendor advisory or security patch from Fit2cloud is referenced in the NVD entry for CVE-2025-70981. Administrators should monitor Fit2cloud release notes for an updated CordysCRM build that addresses CWE-89 in the employee list query interface. Until a fix is available, treat all CordysCRM 1.4.1 deployments as vulnerable.

Workarounds

Place CordysCRM behind an authenticating reverse proxy to prevent unauthenticated access to /user/list
Apply WAF input validation that enforces a strict numeric or comma-separated integer format on departmentIds
Limit the CordysCRM database account to least-privilege permissions, removing rights to access tables outside the application schema
Disable or block the /user/list endpoint at the gateway if it is not required for business operations

bash

# Example NGINX rule restricting departmentIds to integer lists
location /user/list {
    if ($arg_departmentIds !~ "^[0-9,]+$") {
        return 400;
    }
    proxy_pass http://cordyscrm_backend;
}