External risk intelligence

CRM SOFTTRADE Infotech SQL Injection Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-31158

The vulnerability exists in the login page of a CRM application. Login portals are designed to be public-facing by default to allow users to authenticate from any location, making the vulnerable surface area directly accessible from the internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical SQL Injection vulnerability affecting CRM software that could allow an attacker to execute code remotely. The concern is that an unauthenticated attacker could potentially gain unauthorized access and control over the system through the login page. The primary implication at this stage is to confirm if this specific CRM software is in use and, if so, to what extent it is exposed.

Attackers can inject malicious code via login.
Critical access risk through public-facing login.
Confirm use and exposure of affected CRM.

Attack Path

How an attacker could exploit the issue

An attacker could reach a CRM application's login page over the internet. By sending specially crafted input to the login form, they can trick the application into running unintended database commands. This could allow the attacker to execute arbitrary code on the system.

No authentication needed.
Login page input.
Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A critical SQL injection vulnerability in the CRM's login page could allow an unauthenticated remote attacker to execute arbitrary code. When supported by the advisory, this could lead to the compromise of sensitive system and user data.

System and user data.
Via unauthenticated network access.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a SQL injection vulnerability in the login page of the CRM SOFTTRADE Infotech application indicates that teams responsible for web applications, identity and access management, and the CRM platform itself should prioritize this issue. The initial focus should be on identifying all instances of this CRM application within the environment, assessing their external reachability and business criticality, and locating the specific asset or application owner for coordinated remediation planning.

Application owners and platform teams.
Confirm external reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CRM SOFTTRADE Infotech?

It is a customer relationship management software application developed by softtradeindia. Businesses use this platform to manage client data, track interactions, and organize internal workflows, typically through a centralized web portal.

How does CVE-2026-31158 allow arbitrary code execution?

This CVE involves a SQL Injection weakness, classified as CWE-89. Because the login page does not properly sanitize input, an attacker can submit malicious database queries that the server executes. This manipulation allows the attacker to bypass normal operations and potentially run their own code on the underlying system.

Do I need to be logged into the CRM to trigger this vulnerability?

No. The vulnerability exists on the login page itself, meaning an attacker does not need an existing account or any form of authentication to initiate the attack. Simply interacting with the login form fields is sufficient to attempt the injection.

Is my instance of this CRM at risk?

According to Halo Surface Signal, this software is very likely at risk because login portals are typically designed to be public-facing to support remote access. If your CRM login page is reachable from the internet, it is directly exposed to this threat.

When should I take action to secure the CRM?

You should act immediately by locating all instances of this software in your network. Prioritize identifying which systems are accessible from the internet, verify the application ownership, and coordinate with your technical teams to plan necessary updates or protective measures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.