CVE-2025-7801

Vulnerability

Overview

A critical SQL injection vulnerability exists in BossSoft CRM 6.0 within the file /crm/module/HNDCBas_customPrmSearchDtl.jsp. The cstid parameter is not properly sanitized before being used in SQL queries, allowing an attacker to inject arbitrary SQL commands. This flaw is classified as critical due to the ease of exploitation and potential impact [1].

Exploitation

The attack can be launched remotely without requiring authentication. An attacker simply sends a crafted HTTP request to the vulnerable endpoint with malicious SQL payloads in the cstid argument. The exploit has been publicly disclosed, increasing the risk of widespread attacks [1].

Impact

Successful exploitation allows an attacker to read, modify, or delete sensitive data in the underlying database. This could lead to complete compromise of the CRM system, including exposure of customer records, credentials, and other confidential information. The attacker may also escalate privileges or pivot to other systems [1].

Mitigation

As of the publication date, no official patch has been released. Users are advised to implement input validation and parameterized queries for the affected parameter. Given the public availability of exploit code, immediate action is recommended to secure installations [1].