Description
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
1Panel-dev CordysCRM
1.4.0affected1.4.1affected
References
- https://vuldb.com/vuln/380045 ↗
- https://vuldb.com/vuln/380045/cti ↗
- https://vuldb.com/cve/CVE-2026-16223 ↗
- https://vuldb.com/submit/858045 ↗
- https://vuldb.com/submit/858046 ↗
- https://github.com/1Panel-dev/CordysCRM/issues/2687 ↗
- https://github.com/1Panel-dev/CordysCRM/issues/2688 ↗
- https://github.com/1Panel-dev/CordysCRM/ ↗