The flaw resides in the getSqlBotSrc method of IntegrationConfigService.java in 1Panel‑dev CordysCRM, allowing a crafted appSecret parameter to trigger outbound HTTP requests to arbitrary URLs. This enables a server‑side request forgery that can expose internal resources or be leveraged for further attacks. The weakness is classified as CWE‑918 and is exploitable remotely.

Affected versions of 1Panel‑dev CordysCRM include 1.4.1 and all earlier releases that contain the Third Party Edit Endpoint component. The vulnerability is present in the IntegrationConfigService.java file, specifically in the getSqlBotSrc function which processes the appSecret argument.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that widespread exploitation is unlikely. However, the public disclosure of the exploit means that remote attackers could still leverage the flaw, especially in environments where the application can reach internal or external systems. The vulnerability is not listed in CISA KEV, but its ability to force outbound requests grants it potential to compromise sensitive network assets if not mitigated.