PT-2026-7867 · Cordyscrm · Cordyscrm

Published 2026-02-12 · Updated 2026-02-12 · CVE-2025-70981

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CordysCRM version 1.4.1

Description CordysCRM version 1.4.1 contains a SQL Injection flaw in the employee list query interface. The issue is located in the /user/list API endpoint and involves manipulation of the departmentIds parameter. Successful exploitation could allow an attacker to inject malicious SQL code.

Recommendations Apply updates to address the SQL Injection flaw in the employee list query interface. As a temporary workaround, restrict access to the /user/list API endpoint. Avoid using the departmentIds parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-70981

Affected Products

Cordyscrm

References · 6

• 🔥 https://github.com/Tomikun2/SQL-Injection-in-CordysCRM/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70981 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70981 · Vendor Advisory
• https://twitter.com/CVEnew/status/2022010390067253723 · Twitter Post
• https://t.me/CVEtracker/44555 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2022023190197789164 · Twitter Post