{"id":"CVE-2026-52745","summary":"CordysCRM: Customer Public Pool Sorting Field SQL Injection","details":"CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.","aliases":["GHSA-xrcr-hj37-q83j"],"modified":"2026-09-20T14:24:10.952213Z","published":"2026-09-18T19:51:17.097Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52745.json"},"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-xrcr-hj37-q83j"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52745.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52745"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/pull/2418"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/1panel-dev/cordyscrm","events":[{"introduced":"0"},{"fixed":"b5b9272c016550d80a789fd8ffbf3d5a4c4bab52"},{"fixed":"7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.7.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.6.2","v1.6.1","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.3","v1.3.2","v1.3.1","v1.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52745.json","vanir_signatures_modified":"2026-09-20T14:24:10Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"138175157171988891496597839656403412500","length":129},"id":"CVE-2026-52745-5c26298c","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java","function":"getName"}},{"source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java","function":"valid"},"deprecated":false,"digest":{"function_hash":"286345402475414238301088048989944224672","length":86},"id":"CVE-2026-52745-90e10bb1","signature_type":"Function","signature_version":"v1"},{"target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["188241862539712192175172578398167825894","179594615474847338835703202072024070006","152899096258213762169703425167293180316","234469426420394583498409641763268385567","52143260877910861663650867471394982101","183263599332975164853313008612879527707","72168469011547547506657716846791337137","22667701420219942695804716072965964859","287048705838848410108335352701668395533","294501796608779565779033014464869912699","7095839689338380934651923328913702244","134778167687728377457202205980022766380","251917009975492951723520550959374938707","149597088211555601921867610014070604948","33442643586097689631382187039490124966","234207140797857642068499116128383195239","242278537025600283629874581333108169557","11859937847181581437132999185891772534"]},"id":"CVE-2026-52745-9764707f","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52"},{"source":"https://github.com/1panel-dev/cordyscrm/commit/7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/approval/mapper/ExtApprovalInstanceMapper.java"},"deprecated":false,"digest":{"line_hashes":["300057984841402190454347434645157421473","220282082689875518599067250696579483920"],"threshold":0.9},"id":"CVE-2026-52745-a5718b56","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"219713864746005372066740679571971458234","length":91},"id":"CVE-2026-52745-adf0527b","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"function":"getName","file":"backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java"}},{"source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java"},"deprecated":false,"digest":{"line_hashes":["251192895385965541042061677703127966922","240458497798116530773452809701608955014","314365953006933930363805529938308649903","315465113101342136394586694052163310230","327267593748800872552510406264223223746","191843073032901003109011242283827697934","314856043858968438143225676995072486103","118933346194867589856916466731178343350","182111468593229504973032326381537202605","325067973984613250915456432563685967084","310971659645125999816435844490488020903","160770462622661424346153512359239256442"],"threshold":0.9},"id":"CVE-2026-52745-c7a32b5e","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-52745-cff5f585","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/approval/service/ApprovalActionService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["264654641498068565163148758720303247925","326319180140202264514769382317587271969","207053217838931752325967036852955105498","49388233016336645149709755269713248646","155526835061659021775855202167188289841","118485121350428657810771187351667871175","250469855315514493926495268485789081327","152047592666521901160313551738195476006","85252776332415329353061921149240507081","262604562922142974165366710064216355354","262475088046163131975242340744163792859","306657523969764582489273493365329137111","191712704461071390710765108468701459976","323168859459042983681696155917142195420","205956062299661666358570989598739035348"]}},{"id":"CVE-2026-52745-e59554ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java","function":"valid"},"deprecated":false,"digest":{"function_hash":"331381921663909720501056826865526669859","length":559}},{"id":"CVE-2026-52745-edcbbc8f","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52","target":{"file":"backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java","function":"checkSqlInjection"},"deprecated":false,"digest":{"function_hash":"235590687037305193319956891311738336728","length":301}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L"}]}