CVE-2026-52745

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-52745
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52745.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-52745
Aliases
  • GHSA-xrcr-hj37-q83j
Published
2026-09-18T19:51:17Z
Modified
2026-09-26T08:12:50Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L CVSS Calculator
Summary
CordysCRM: Customer Public Pool Sorting Field SQL Injection
Details

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULE_SETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation of the sorting field. The resulting time-based blind SQL injection can confirm database expression execution, infer database metadata and sensitive values, and introduce database delays that degrade service. This issue is fixed in version 1.7.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52745.json"
}
References

Affected packages

Git / github.com/1panel-dev/cordyscrm

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/cordyscrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b5b9272c016550d80a789fd8ffbf3d5a4c4bab52
Fixed
7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52745.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "138175157171988891496597839656403412500",
            "length": 129
        },
        "id": "CVE-2026-52745-5c26298c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java",
            "function": "getName"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "286345402475414238301088048989944224672",
            "length": 86
        },
        "id": "CVE-2026-52745-90e10bb1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java",
            "function": "valid"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "188241862539712192175172578398167825894",
                "179594615474847338835703202072024070006",
                "152899096258213762169703425167293180316",
                "234469426420394583498409641763268385567",
                "52143260877910861663650867471394982101",
                "183263599332975164853313008612879527707",
                "72168469011547547506657716846791337137",
                "22667701420219942695804716072965964859",
                "287048705838848410108335352701668395533",
                "294501796608779565779033014464869912699",
                "7095839689338380934651923328913702244",
                "134778167687728377457202205980022766380",
                "251917009975492951723520550959374938707",
                "149597088211555601921867610014070604948",
                "33442643586097689631382187039490124966",
                "234207140797857642068499116128383195239",
                "242278537025600283629874581333108169557",
                "11859937847181581437132999185891772534"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-52745-9764707f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "300057984841402190454347434645157421473",
                "220282082689875518599067250696579483920"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-52745-a5718b56",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/approval/mapper/ExtApprovalInstanceMapper.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "219713864746005372066740679571971458234",
            "length": 91
        },
        "id": "CVE-2026-52745-adf0527b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java",
            "function": "getName"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "251192895385965541042061677703127966922",
                "240458497798116530773452809701608955014",
                "314365953006933930363805529938308649903",
                "315465113101342136394586694052163310230",
                "327267593748800872552510406264223223746",
                "191843073032901003109011242283827697934",
                "314856043858968438143225676995072486103",
                "118933346194867589856916466731178343350",
                "182111468593229504973032326381537202605",
                "325067973984613250915456432563685967084",
                "310971659645125999816435844490488020903",
                "160770462622661424346153512359239256442"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-52745-c7a32b5e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "264654641498068565163148758720303247925",
                "326319180140202264514769382317587271969",
                "207053217838931752325967036852955105498",
                "49388233016336645149709755269713248646",
                "155526835061659021775855202167188289841",
                "118485121350428657810771187351667871175",
                "250469855315514493926495268485789081327",
                "152047592666521901160313551738195476006",
                "85252776332415329353061921149240507081",
                "262604562922142974165366710064216355354",
                "262475088046163131975242340744163792859",
                "306657523969764582489273493365329137111",
                "191712704461071390710765108468701459976",
                "323168859459042983681696155917142195420",
                "205956062299661666358570989598739035348"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-52745-cff5f585",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/7c2eadb9d76cc6613e6ccc7089c1c2f77480ecad",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/approval/service/ApprovalActionService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "331381921663909720501056826865526669859",
            "length": 559
        },
        "id": "CVE-2026-52745-e59554ed",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/condition/FilterCondition.java",
            "function": "valid"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "235590687037305193319956891311738336728",
            "length": 301
        },
        "id": "CVE-2026-52745-edcbbc8f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b5b9272c016550d80a789fd8ffbf3d5a4c4bab52",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java",
            "function": "checkSqlInjection"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:12:50Z"