Free-CRM Administrative Interface Allows Remote Code Execution

Summary

A security issue was found in Free-CRM's Administrative Interface, which could allow an attacker to execute unauthorized code on the system. This could happen if an attacker manipulates the system in a specific way. Since the vulnerability has been publicly disclosed, it's possible that malicious individuals may try to exploit it. If you use Free-CRM, check with the vendor for information on how to protect your system.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
go2ismail	free-crm	<= 2025-09-21	–

Original title

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. ...

Original description

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this issue is some unknown functionality of the component Administrative Interface. Executing a manipulation can lead to execution after redirect. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 6.5

nvd CVSS3.1 8.8

nvd CVSS4.0 5.3

Vulnerability type

CWE-698

CWE-705

https://github.com/Ghufran2/CVE-Free-CRM-Advisories/blob/main/Free-CRM%20Privile... Exploit Mitigation Third Party Advisory
https://vuldb.com/?ctiid.347987 Permissions Required VDB Entry
https://vuldb.com/?id.347987 Third Party Advisory VDB Entry
https://vuldb.com/?submit.758337 Third Party Advisory VDB Entry