SQL Injection in CRM+ Application

Executive Summary

The CRM+ application from Brainformatik before version 2025.6 has a time-based SQL injection vulnerability in the CheckConflictOfDates endpoint. This allows attackers to manipulate the userId parameter in POST requests to execute arbitrary SQL commands, potentially accessing or modifying the MySQL database.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability, monitor network traffic for suspicious requests to the endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true. Use tools like Burp Suite to intercept and inspect POST requests for manipulated userId parameters. Test with SQLMap by sending crafted payloads to the endpoint to observe time delays or errors.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive data in the database, such as user credentials, appointments, or other confidential information. They could also manipulate data, cause delays in system responses, or potentially take control of the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR's data protection requirements. For HIPAA, if the CRM+ handles protected health information, the breach could compromise compliance with security and privacy rules.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update CRM+ to the latest version beyond 2025.6. Apply input validation and parameterized queries to the CheckConflictOfDates endpoint. Restrict access to the vulnerable endpoint via firewall rules or network segmentation. Monitor database logs for unusual queries or delays.

Useful 0 Not Useful 0