A blind SQL injection flaw resides in the NetBoard CRM Demo Platform’s /module/auth/recovery.php endpoint, where the ‘user‑name’ POST parameter is not properly sanitized. Attackers can exploit Boolean, error, time‑based, and UNION techniques to query the backend database. The exploitation enables retrieval of confidential information, alteration of stored data, and potential lateral movement within the CRM environment, thereby compromising both confidentiality and integrity.

The vulnerability applies to all installations of the NetBoard CRM Demo Platform. No specific version details are disclosed, meaning that every instance where the vulnerable endpoint is active is potentially at risk.

The flaw merits a CVSS score of 10, indicating the highest severity level. EPSS data is unavailable, and the issue is not present in CISA’s KEV catalog. The most probable attack vector is through the web interface; a remote actor capable of sending crafted POST requests to /module/auth/recovery.php can trigger the blind SQL injection. Given the ability to exfiltrate sensitive data and modify database contents, the threat to the affected CRM environment is substantial.