Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:16:57.290Z",
  "pubdate": "2026-11-05T19:16:57.290Z",
  "executiveSummary": "The Project Template module in SuiteCRM is susceptible to a blind SQL injection vulnerability due to improper input validation.\nThis vulnerability is categorized as a critical security flaw allowing authenticated attackers to execute arbitrary SQL queries against the application database.\nAffected products include SuiteCRM versions prior to 7.15.2 and 8.10.2.\nThe security impact is significant, as it enables unauthorized extraction of sensitive information, including customer records, internal communications, and authentication credentials.\nExploitation requires the attacker to possess authenticated access to the application; however, no additional elevated privileges are explicitly required beyond basic user authentication.\nThe root cause lies in the direct interpolation of user-supplied POST parameters into database queries without the use of parameterized statements or adequate sanitization.\nSuccessful exploitation facilitates data exfiltration and potential compromise of the entire backend database, representing a severe risk to data confidentiality and integrity.",
  "technicalDetails": "The vulnerability resides within the Project Template module, specifically targeting the 'action_get_end_date' function. This function handles server-side logic by processing user input submitted via POST requests.\nThe root cause is the insecure handling of the 'task_id' and 'lag' parameters. The application logic fails to employ parameterized queries or prepared statements, instead directly concatenating these input values into the backend SQL command strings.\nBecause these inputs are not sanitized, escaped, or validated, an authenticated user can inject malicious SQL syntax into the query structure. The vulnerability manifests as a blind SQL injection, meaning the attacker cannot directly see the results of the query in the response but can infer data by observing variations in application behavior or response times based on boolean-based or time-based conditions.\nThe attack flow begins when an authenticated attacker submits a crafted POST request targeting the 'action_get_end_date' function. The attacker modifies the 'task_id' or 'lag' parameters to include SQL payloads. For instance, an attacker could append conditional logic (e.g., 'AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)') to trigger time-based delays, allowing the attacker to exfiltrate data bit-by-bit.\nThe database server executes the modified query, enabling the attacker to probe the database schema, perform data enumeration, or extract sensitive tables. Given the scope of data stored within a CRM, this impact often includes the retrieval of personally identifiable information (PII), system configurations, and administrative credentials.\nThe vulnerability affects all instances of SuiteCRM running versions prior to 7.15.2 and 8.10.2. The attack is restricted to authenticated sessions, but because the CRM environment often includes a wide range of user roles, this vector remains a significant threat if any user account is compromised or if malicious insiders are present.\nPost-exploitation, the impact ranges from unauthorized data disclosure to potential database-level administrative command execution if the database user permissions are overly permissive. This defect demonstrates a failure in secure coding practices, specifically regarding the separation of data from executable code in database interactions."
}