CyberRota Analysis
AI-GeneratedA vulnerability exists in the 1Panel-dev CordysCRM versions up to 1.4.1, specifically in the getSqlBotSrc function of the IntegrationConfigService.java file, which allows for server-side request forgery through manipulation of the appSecret argument. This issue can be exploited remotely, potentially leading to unauthorized access to internal services. Organizations using affected versions of CordysCRM should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.