Vulnerability · Published Sep 19, 2025 · Assigned by VulDB

CVE-2025-1071207FLYCMS/07FLY-CMS/07FlyCRM login sql injection

High 7.3

In plain English

A high-severity SQL injection in 07FLY-CMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This issue affects some unknown processing of the file /index.php/Login/login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. This product is published under multiple names. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
n/a	07FLYCMS	20250831
n/a	07FLY-CMS	20250831
n/a	07FlyCRM	20250831

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-325000 | 07FLYCMS/07FLY-CMS/07FlyCRM login sql injection vdb-entry, technical-description
VDB-325000 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #644970 | 07FLY Customer Management System V1.0 SQL Injection third-party-advisory
https://github.com/1276486/CVE/issues/13 exploit, issue-tracking