PT-2025-30087 · Bosssoft · Bosssoft Crm Version 6.0

Cc2024K · Published 2025-07-18 · Updated 2025-07-18 · CVE-2025-7801

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BossSoft CRM version 6.0

Description A critical issue exists in BossSoft CRM 6.0 related to SQL injection. The vulnerability is located in an unknown functionality within the file /crm/module/HNDCBas customPrmSearchDtl.jsp. Manipulation of the cstid argument can lead to exploitation, allowing for remote attacks. The exploit has been publicly disclosed.

Recommendations Address the SQL injection issue in the /crm/module/HNDCBas customPrmSearchDtl.jsp file by sanitizing or validating the cstid argument.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-7801

Affected Products

Bosssoft Crm Version 6.0

References · 7

• 🔥 https://github.com/cc2024k/CVE/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7801 · Security Note
• https://t.me/cvetracker/28169 · Telegram Post
• https://twitter.com/CVEnew/status/1946282038182498580 · Twitter Post
• https://vuldb.com/?submit.616840 · Note
• https://vuldb.com/?ctiid.316867 · Note
• https://vuldb.com/?id.316867 · Note