Technical impact
This vulnerability permits a remote attacker to execute arbitrary code via a SQL injection flaw in the login page of Softtrade Infotech CRM (softtradeindia) version 1.0. By injecting crafted SQL statements into the username or password fields, the database executes them, allowing the attacker to compromise the application and underlying data. The flaw allows bypassing authentication, thereby exposing the entire system to compromise of confidentiality, integrity, and availability.
Affected Systems
The impacted product is Softtrade Infotech’s CRM software, softtradeindia, version 1.0. No other vendors or products are referenced in the CVE data.
Risk and Exploitability
The CVSS score is 9.8. The EPSS score is < 1% (≈0.004), indicating a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it can be inferred that an attacker would send specially crafted credentials to exploit the SQL injection, requiring no prior authentication or privileged access. Successful exploitation would grant full control over the hosting server and all stored data.
