Daffodil CRM does not properly sanities it's input’s on the login page;

http://www.SITE.com:8080/daffodilcrm/userlogin.jsp

Therefore SQL-injection attacks are possible.
PoC could be: 1'or'1'='1

Vendor’s homepage is: http://www.daffodildb.com/crm/

Please credit to: Preben Nyløkken