Summary
EspoCRM contains a Boolean-based blind SQL injection vulnerability in the where parameter of the entity streamAttachments endpoint. An authenticated non-administrator may exploit crafted query expressions to retrieve database information, including active administrator session tokens, potentially enabling privilege escalation.
EspoCRM contains a Boolean-based blind SQL injection vulnerability in the where parameter of the entity streamAttachments endpoint. An authenticated non-administrator may exploit crafted query expressions to retrieve database information, including active administrator session tokens, potentially enabling privilege escalation.
Affected context
The issue affects EspoCRM deployments where an authenticated user can access the entity streamAttachments endpoint and submit complex expressions through its where query parameter. Risk is higher when the endpoint passes user-controlled filtering logic into database queries without reliably separating data values from query structure.
The issue affects EspoCRM deployments where an authenticated user can access the entity streamAttachments endpoint and submit complex expressions through its where query parameter. Risk is higher when the endpoint passes user-controlled filtering logic into database queries without reliably separating data values from query structure.
Exploit preconditions
- Attack surface: The HTTP
GET entity streamAttachmentsendpoint - Required access: An authenticated account, including a non-administrator account
- Trigger point: Processing of a crafted
whereparameter - Why exploitation is possible: Complex query expressions may reach database logic without sufficient parameterization or expression restrictions, allowing Boolean-based inference of database contents
- Attack surface: The HTTP
GET entity streamAttachmentsendpoint - Required access: An authenticated account, including a non-administrator account
- Trigger point: Processing of a crafted
whereparameter - Why exploitation is possible: Complex query expressions may reach database logic without sufficient parameterization or expression restrictions, allowing Boolean-based inference of database contents
Why this happens
The vulnerability is caused by an unsafe translation of user-controlled query expressions into database operations. When filtering syntax is interpreted as executable SQL structure rather than treated strictly as data or validated against an allowlist, an attacker may infer sensitive values through differences in application responses. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
The vulnerability is caused by an unsafe translation of user-controlled query expressions into database operations. When filtering syntax is interpreted as executable SQL structure rather than treated strictly as data or validated against an allowlist, an attacker may infer sensitive values through differences in application responses. This behavior maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').
Potential impact
- Sensitive database information may be disclosed
- Administrator session tokens could be extracted
- An attacker may escalate from a regular authenticated account to administrative privileges
- Customer, configuration, or application data could be exposed or modified
- Compromised sessions may enable broader application abuse
- Sensitive database information may be disclosed
- Administrator session tokens could be extracted
- An attacker may escalate from a regular authenticated account to administrative privileges
- Customer, configuration, or application data could be exposed or modified
- Compromised sessions may enable broader application abuse
General mitigation guidance
Mitigation generally focuses on ensuring that query construction cannot interpret user input as SQL syntax.
Common defensive patterns include:
- Use parameterized queries or approved query-builder abstractions for all database operations
- Restrict filtering expressions to a narrowly defined allowlist of fields, operators, and value types
- Validate and normalize query parameters before they reach persistence-layer code
- Avoid exposing generic expression evaluators through user-facing endpoints
- Apply least-privilege permissions to application database accounts
- Protect session tokens with appropriate scoping, rotation, expiration, and invalidation controls
- Return consistent responses that reduce the usefulness of Boolean inference
Mitigation generally focuses on ensuring that query construction cannot interpret user input as SQL syntax.
Common defensive patterns include:
- Use parameterized queries or approved query-builder abstractions for all database operations
- Restrict filtering expressions to a narrowly defined allowlist of fields, operators, and value types
- Validate and normalize query parameters before they reach persistence-layer code
- Avoid exposing generic expression evaluators through user-facing endpoints
- Apply least-privilege permissions to application database accounts
- Protect session tokens with appropriate scoping, rotation, expiration, and invalidation controls
- Return consistent responses that reduce the usefulness of Boolean inference
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Static analysis rules for string concatenation or interpolation in SQL and query-builder calls
- Code review checks for endpoints that accept generic filtering or expression parameters
- Dynamic testing that compares responses for controlled true and false database conditions
- API policy enforcement restricting accepted fields, operators, and query complexity
- Monitoring for unusual filtering patterns, repeated conditional requests, and access to sensitive endpoints
- Automated security testing and code-review tools that identify unparameterized database access
Organizations commonly detect this class of issue through:
- Static analysis rules for string concatenation or interpolation in SQL and query-builder calls
- Code review checks for endpoints that accept generic filtering or expression parameters
- Dynamic testing that compares responses for controlled true and false database conditions
- API policy enforcement restricting accepted fields, operators, and query complexity
- Monitoring for unusual filtering patterns, repeated conditional requests, and access to sensitive endpoints
- Automated security testing and code-review tools that identify unparameterized database access
