Low Severity
CVE-2026-31158
Published: Nov 2, 2026
# CVE-2026-31158
## Security Advisory: Unauthenticated Boolean-Based SQL Injection in CRM Login Functionality
## Summary
A Boolean-based SQL Injection vulnerability was reported in the login functionality of a CRM web application hosted at `crm.softtradeindia.com`. Improper handling of user-supplied input in the `TxtUsername` parameter may allow an attacker to manipulate backend SQL query logic and potentially bypass authentication controls.
**Scope of impact:** The reported vulnerability affects the application's login functionality. If authentication bypass is confirmed, a remote attacker without valid credentials may gain unauthorized access to protected application functionality. The actual impact depends on the backend implementation, database permissions, and authorization controls.
- **CWE:** CWE-89 (Improper Neutralization of Special Elements Used in an SQL Command)
- **Vulnerability type:** Boolean-Based SQL Injection
- **Attack vector:** Remote / Network
- **Authentication required:** No, for the reported attack scenario
- **Affected application:** CRM web application
- **Affected version:** 1.1
- **Component:** Login functionality
- **Parameter:** `TxtUsername`
- **HTTP method:** POST
## Details
The vulnerability was reported in the login functionality, where the `TxtUsername` parameter processes user-supplied input.
If the application incorporates this input into a dynamically constructed SQL query without proper parameterization, specially crafted input may alter the intended query logic.
Boolean-based SQL Injection involves influencing SQL conditions and observing application behavior to determine whether user input affects the backend query.
The underlying SQL statement, database engine, and exact implementation details have not been independently confirmed.
## Proof of Concept
The vulnerability was reported in the login page:
```text
http://crm.softtradeindia.com/
```
Reproduction overview:
1. Navigate to the CRM application's login pa