NetBoard CRM Demo Platform: SQL injection in recovery.php user-name parameter
Summary
The NetBoard CRM demo platform contains an SQL injection flaw in the 'user-name' POST parameter of the /module/auth/recovery.php endpoint. The endpoint is reachable without authentication, and the flaw allows blind Boolean, error-based, time-based and UNION-based techniques. An attacker can extract confidential data such as the database version and type, alter data, or further compromise the CRM environment. The CVSS v4.0 base score from the CNA is 10.0 (Critical), while VulDB rates it 6.3.
Affected
- NetBoard CRM Demo Platform, latest demo version (November 2025) per INCIBE
- Affected range per CNA record: versions before 08/10/2026 (date-based, no version numbers published)
- Production editions: Unknown.
Fixed in
- Unknown. No solution has been reported as yet.
Workaround
- None published by the vendor or the CNA.
Exploitation
- Not marked as known exploited (CISA KEV: No).
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Take the demo instance offline or remove it from any internet-facing or untrusted network.
- If it must run, restrict access to trusted IP addresses and place a web application firewall in front of it.
- Do not reconnect it until the vendor confirms a fix for recovery.php.
- Check whether any production CRM uses the same code and whether it is internet-facing.
- Review logs for unusual requests to /module/auth/recovery.php, noting that blind and time-based attacks may leave few errors.
- Ask the vendor whether production editions are affected and when a fix will be available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- INCIBE-CERT notice INCIBE-2026-719 www.incibe.es
- VulDB entry CVE-2026-12260 vuldb.com
- HOL Guard CVE-2026-12260 hol.org
- Strix CVE-2026-12260 www.strix.ai
- ThreatInt CVE-2026-12260 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:32.
Original description (NVD)
SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.