CVE-2025-10712

Root

Cause The vulnerability exists in the /index.php/Login/login endpoint of 07FLYCMS (also known as 07FLY-CMS and 07FlyCRM) versions up to 20250831. The Username parameter in POST requests is not properly validated or sanitized, allowing SQL injection. The unsanitized input is directly incorporated into backend database queries, enabling attackers to manipulate the query logic [1].

Exploitation

Exploitation requires no authentication and can be performed remotely. An attacker sends a crafted HTTP POST request to the login endpoint with a malicious SQL payload (e.g., 1' or 1=1 --) in the username field and any arbitrary password. The server executes the manipulated query, bypassing the authentication check [1]. The exploit has been publicly disclosed, increasing the risk of widespread attacks.

Impact

Successful exploitation allows an attacker to bypass the legitimate login process and gain unauthorized access to the system without valid credentials. This can lead to full administrative control, enabling attackers to view, modify, or steal sensitive business data such as customer information, sales records, and financial data. Additionally, attackers can alter system configurations and disrupt normal business operations [1].

Mitigation

The vendor was contacted but did not respond, and no official patch or workaround has been released. Users should consider hardening the affected system by implementing input validation and parameterized queries, or migrating to a supported alternative if the product is end-of-life.