Description

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is vulnerable to SQL injection allowing an attacker to execute arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T18:17:08.880Z",
  "pubdate": "2026-08-17T18:17:08.880Z",
  "executiveSummary": "An SQL Injection (time-based) vulnerability has been identified in the CRM+ application by Brainformatik, affecting all versions up to and including 2025.6. This security flaw resides within the calendar conflict checking functionality exposed via the application endpoint. An unauthenticated or authenticated remote attacker can exploit this vulnerability by injecting malicious SQL statements into vulnerable parameters processed by the backend database. Successful exploitation of this vulnerability allows threat actors to manipulate database queries, potentially leading to unauthorized data access and the execution of arbitrary code within the underlying system environment. The risk implication is critical, as it compromises the confidentiality, integrity, and availability of the affected CRM+ deployment. Exploitation requires network access to the target application and the ability to interact with the specific AJAX endpoint handling date conflict verification. Remediation requires updating the application to a patched version or applying input sanitization and parameterized queries to the affected component.",
  "technicalDetails": "The vulnerability is classified as a time-based SQL Injection flaw affecting the CRM+ application developed by Brainformatik. The root cause stems from insufficient input validation and a lack of parameterized queries when handling user-supplied data within database interaction routines. Specifically, the vulnerable component is exposed via the check conflict endpoint located at index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true, which is natively utilized by the application to evaluate scheduling conflicts within the user calendar module. During the attack flow, a malicious actor submits crafted input containing SQL syntax into the parameters processed by this endpoint. Because the application improperly concatenates or directly embeds this untrusted input into the SQL query structure without adequate sanitization, the database interpreter evaluates the injected commands as part of the query logic. Due to the time-based nature of the injection, the attacker leverages conditional delay functions, such as database-specific sleep commands, to infer information from the database bit-by-bit based on response latency. The affected versions include the CRM+ application before and including version 2025.6. Network exposure is present wherever the web interface is accessible to users or attackers over HTTP or HTTPS protocols. Depending on the database configuration and underlying database user privileges, successful exploitation can progress beyond data exfiltration, ultimately granting the attacker capabilities to execute arbitrary code on the hosting server or underlying operating system. The vulnerability requires direct network access to the vulnerable script, and while specific privilege requirements are not strictly defined, exploitation bypasses intended application logic to interact directly with the database management system."
}