Executive brief
SuiteCRM is an open-source customer relationship management (CRM) platform used by businesses to manage customer data and sales workflows. A security flaw in the user management module allows an authorized user to perform unauthorized database queries. This could lead to the exposure of sensitive business information or customer data stored within the CRM database.
Technical details
A time-based blind SQL injection vulnerability exists in SuiteCRM version 7.10.7 and potentially earlier versions. The flaw is located in the 'record' parameter of the 'DetailView' action within the 'Users' module. An authenticated attacker can exploit this by sending specially crafted GET requests to the index.php endpoint, appending SQL commands to the record parameter. Because the application fails to properly neutralize these special elements, the attacker can infer sensitive information from the database based on the time delay of the server's response. While authentication is required, any user with access to the Users module can potentially extract the entire database content.
Affected products
- SalesAgility SuiteCRM 7.10.7 and earlier
Timeline
- 2019-02-04: disclosed: Exploit code published on Exploit-DB
- 2026-04-05: advisory: NVD/VulnCheck advisory published