CVE-2026-52745: CordysCRM SQL Injection Vulnerability

CVE-2026-52745 Overview

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. The POST /account-pool/page endpoint accepts a sort.name parameter that is concatenated into a dynamic SQL ORDER BY clause without strict server-side validation. An authenticated caller holding the MODULE_SETTING:UPDATE permission can inject SQL expressions that trigger time-based blind SQL injection [CWE-89]. Attackers can confirm expression execution, infer database metadata, extract sensitive values one bit at a time, and introduce artificial delays that degrade service availability. The issue is fixed in CordysCRM version 1.7.0.

Critical Impact
Authenticated attackers with MODULE_SETTING:UPDATE privileges can exfiltrate sensitive database contents and impact service availability through blind SQL injection.

Affected Products

CordysCRM versions prior to 1.7.0
The POST /account-pool/page endpoint accepting SortRequest objects
Deployments using the vulnerable FilterCondition and dynamic ORDER BY handling

Discovery Timeline

2026-09-18 - CVE CVE-2026-52745 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-52745

Vulnerability Analysis

The vulnerability resides in CordysCRM's sorting logic. The POST /account-pool/page endpoint accepts a JSON body containing a sort object with a name field. That value is inserted into a dynamically constructed SQL ORDER BY expression at the persistence layer. Because parameterized queries cannot bind identifiers such as column names, the server relied on inline concatenation without enforcing an allowlist of legal sort fields.

An authenticated caller with the MODULE_SETTING:UPDATE permission can submit crafted sort.name values containing SQL fragments. The database executes conditional expressions with functions like SLEEP() or pg_sleep(), and the resulting response latency reveals the truth value of the injected predicate. Iterating this pattern lets an attacker extract database metadata and sensitive record values one character at a time.

Root Cause

The root cause is missing server-side validation of the sort field identifier before its inclusion in a dynamic ORDER BY clause. The SortRequest and FilterCondition classes did not screen user-supplied identifiers against an allowlist or a syntactic pattern. The fix introduces a SqlInjectionChecker utility that validates sort and filter inputs before they reach the SQL builder.

Attack Vector

Exploitation requires network access to the CordysCRM API, valid authentication, and the MODULE_SETTING:UPDATE privilege. The attacker sends a POST request to /account-pool/page with a sort.name value crafted to include an SQL time-delay expression. Measured response times disclose the boolean result of each injected predicate, enabling incremental data exfiltration.

java

// Security patch: SortRequest.java
 package cn.cordys.common.dto;
 
+import cn.cordys.common.utils.SqlInjectionChecker;
 import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.Pattern;
 import lombok.AllArgsConstructor;

// Security patch: FilterCondition.java
 package cn.cordys.common.dto.condition;
 
 import cn.cordys.common.constants.EnumValue;
-import cn.cordys.common.dto.SortRequest;
 import cn.cordys.common.exception.GenericException;
+import cn.cordys.common.utils.SqlInjectionChecker;

Source: GitHub Commit b5b9272

Detection Methods for CVE-2026-52745

Indicators of Compromise

Requests to POST /account-pool/page containing SQL keywords such as SLEEP, BENCHMARK, pg_sleep, CASE WHEN, or IF( inside the sort.name field.
Anomalous response times on /account-pool/page responses, particularly repeated requests with monotonically stepped latency.
Application logs showing repeated ORDER BY parse errors originating from the account-pool controller.

Detection Strategies

Inspect API request bodies for non-alphanumeric characters, whitespace, or SQL syntax in sort.name and filter fields.
Alert on database query logs where ORDER BY clauses contain function calls or subqueries rather than simple column references.
Correlate authenticated sessions holding MODULE_SETTING:UPDATE with sudden bursts of /account-pool/page traffic.

Monitoring Recommendations

Enable slow-query logging on the CordysCRM database and review entries tied to account-pool sorting operations.
Deploy a web application firewall rule that blocks SQL metacharacters in the sort.name JSON field.
Track request-duration percentiles for /account-pool/page and alert on sustained deviations from baseline.

How to Mitigate CVE-2026-52745

Immediate Actions Required

Upgrade CordysCRM to version 1.7.0 or later, which introduces the SqlInjectionChecker validation for sort and filter inputs.
Audit user accounts assigned the MODULE_SETTING:UPDATE permission and revoke it where not required.
Rotate any database credentials or API keys that may have been exposed through prior sort-field manipulation.

Patch Information

The fix is delivered in CordysCRM v1.7.0. See GitHub Release v1.7.0, the corrective Pull Request #2418, and GitHub Security Advisory GHSA-xrcr-hj37-q83j. The commit b5b9272 refactors SortRequest and FilterCondition to route user-supplied identifiers through SqlInjectionChecker.

Workarounds

Restrict the MODULE_SETTING:UPDATE role to a minimal set of trusted administrators until the upgrade is applied.
Place a reverse proxy or WAF in front of CordysCRM that rejects requests containing SQL metacharacters in JSON sort fields.
Enforce database-user least privilege so the CordysCRM application role cannot read tables outside its operational scope.

bash

# Example WAF rule (ModSecurity) to block SQL syntax in sort.name
SecRule REQUEST_URI "@streq /account-pool/page" \
    "phase:2,chain,deny,status:400,id:1052745,\
    msg:'CVE-2026-52745 blind SQLi attempt in sort.name'"
  SecRule REQUEST_BODY "@rx \"sort\"\s*:\s*\{[^}]*\"name\"\s*:\s*\"[^\"]*(sleep|benchmark|pg_sleep|case\s+when|--|;)" \
    "t:lowercase"