A flaw in go2ismail’s Free‑CRM administrative interface permits an attacker to alter the redirect logic after a user submits a form or logs in. By manipulating the redirect parameter, the attacker can force the application to send the authenticated user to a malicious domain. The vulnerability is triggered remotely, and while it does not grant arbitrary code execution, it can be used to facilitate phishing, credential forwarding, or other social‑engineering attacks that depend on redirecting logged‑in users to attacker‑controlled sites. The weakness is classified under CWE‑698 and CWE‑705.

The target product is go2ismail Free‑CRM. The flaw exists in all releases up to commit b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Because the project uses a rolling release model, version numbers are not publicly tracked, so administrators should treat all current deployments as potentially vulnerable until a newer release is found that removes the redirect manipulation logic.

With a CVSS v3 score of 5.3, the vulnerability scores as medium severity. The EPSS score is less than 1 %, suggesting that widespread exploitation is unlikely. The vulnerability is not present in CISA’s KEV catalog. Attackers can exploit it remotely against the administrative interface without sophisticated prerequisites, provided they can reach the login or form submission endpoint. The lack of an official patch and the vendor’s unresponsive stance elevate the risk if the weakness is leveraged in a targeted campaign, but the overall threat remains moderate without an available exploit chain.