{"id":"CVE-2026-31158","kind":"vulnerability","aliases":["CVE-2026-31158"],"related":[],"title":"CRM SOFTTRADE Infotech 1.0: login page SQL injection allows remote code execution","description":"SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page","summary":"The SOFTTRADE Infotech CRM version 1.0 login page does not sanitize input before it reaches a SQL query. A remote attacker can inject SQL through the login form and, according to the description, execute arbitrary code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","other","softtradeindia","sql-injection"],"not_affected_if":["product-not-deployed"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T15:16:40+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","triaged_at":"2026-10-26T16:04:13+00:00","updated_at":"2026-10-26T16:04:13+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T16:04:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"CRM SOFTTRADE Infotech 1.0: login page SQL injection allows remote code execution","impact":"high","summary":"The SOFTTRADE Infotech CRM version 1.0 login page does not sanitize input before it reaches a SQL query. A remote attacker can inject SQL through the login form and, according to the description, execute arbitrary code.","category":"other","nicknames":[],"who_cares":["softtradeindia","crm","sql-injection"],"confidence":0.5,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the CRM server via login","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-31158 for CVSS score, affected versions and any vendor fix; the sources give no severity or fixed version.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["product-not-deployed"],"who_is_affected":"Teams that run the SOFTTRADE Infotech CRM (softtradeindia) version 1.0 with its login page reachable from the network are affected. The sources do not say which deployments or configurations are required. Teams that do not run this CRM can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000564,"input_tokens":3291,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-31158':15A,18A '1.0':4A,30B,70C 'accord':54B 'aka':68C 'allow':9A,71C 'arbitrari':59B,77C 'attack':45B,74C 'code':11A,60B,78C 'crm':1A,19B,28B,65C 'cve':13A,16A 'descript':57B 'execut':12A,58B,76C 'form':52B 'infotech':3A,27B,67C 'inject':8A,24B,47B,62C 'input':36B 'login':5A,31B,51B,81C 'page':6A,32B,82C 'queri':42B 'reach':39B 'remot':10A,44B,73C 'sanit':35B 'softtrad':2A,26B,66C 'softtradeindia':21B,69C 'sql':7A,23B,41B,48B,61C 'sql-inject':22B 'version':29B 'via':79C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the SOFTTRADE Infotech CRM (softtradeindia) version 1.0 with its login page reachable from the network are affected. The sources do not say which deployments or configurations are required. Teams that do not run this CRM can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T15:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-31158","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31158","severity":null,"published_at":"2026-10-26T15:16:40+00:00","modified_at":"2026-10-26T15:16:40+00:00","first_seen_at":"2026-10-26T16:02:25+00:00","fetched_at":"2026-10-26T16:02:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}