CRM softtradeindia: SQL injection in login page

Summary

The login page of the CRM softtradeindia web application is reportedly vulnerable to boolean-based SQL injection via the TxtUsername parameter. An unauthenticated remote attacker could alter the backend SQL query and possibly bypass authentication, with the real impact depending on the backend implementation and database permissions. The sources do not confirm remote code execution, despite the wording in the CVE description. The CVSS score of 9.8 is unverified, NVD status is Deferred, and no vendor fix is known.

Affected

• CRM softtradeindia by SoftTrade Infotech, version 1.0 according to the CVE record and VulDB; the reporter's repository names version 1.1. Unresolved.
• Login functionality, parameter TxtUsername (HTTP POST)
• NVD lists no product or version data.

Fixed in

Unknown. No vendor advisory, PSIRT entry or patch was found.

Workaround

• Restrict access to the CRM login (VPN, IP allowlist or internal network only)
• Limit the database account to the privileges the CRM needs
• Monitor authentication logs for unusual input

Exploitation

• No evidence of exploitation in the wild; the CVE is not in CISA KEV.
• Public exploit status unclear: the reporter's GitHub repository (published 23 Oct 2026) was not verified for exploit code.
• CISA SSVC assessment: exploitation PoC, automatable yes, technical impact total.

Our recommendation

• Inventory all instances of this CRM, including hosted and self-hosted copies and any shadow IT use.
• Restrict login access as described above until a fix is confirmed.
• Ask the vendor in writing for a fix, a timeline and a security contact.
• Have the login code reviewed or tested for SQL injection and apply parameterized queries if you maintain the code.
• Treat the 9.8 score as an upper bound until NVD or the vendor scores the CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hardik007007/CVE-2026-31158-Boolean-Based-SQL-Injection-in-CRM-Login

Research sources

• Reporter's GitHub repository (CVE-2026-31158) github.com
• VulDB entry 426471 vuldb.com
• OpenCVE CVE-2026-31158 app.opencve.io
• OffSeq Radar threat entry radar.offseq.com
• PSIRT CVE-2026-31158 psirt.com
• Strix CVE-2026-31158 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:34.