Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:16:59.133Z",
  "pubdate": "2026-11-05T19:16:59.133Z",
  "executiveSummary": "This vulnerability is an SQL injection flaw identified in SuiteCRM's AOR_Reports module. The issue arises from the insecure handling of field labels during the construction of ORDER BY clauses, which are dynamically concatenated without sufficient validation or an allowlist mechanism.\nThe vulnerability allows an authenticated user with access to AOR Reports to manipulate database queries. By injecting malicious SQL syntax, an attacker can perform time-based blind SQL injection, potentially exfiltrating sensitive information such as password hashes and arbitrary database contents.\nFurthermore, the vulnerability enables resource exhaustion attacks, as attackers can force the database to execute computationally expensive expressions, leading to a denial-of-service condition by holding database connections.\nThe vulnerability affects SuiteCRM versions prior to 7.15.2 and 8.10.2. Exploitation requires authenticated access to the application's reporting functionality. Organizations utilizing SuiteCRM are at significant risk of data breach and service instability if the application remains unpatched.\nGiven the nature of CRM systems storing sensitive customer and system data, this vulnerability is critical, necessitating an immediate update to the latest patched versions.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper neutralization of user-controlled input within the AOR_Reports module. The application's reporting engine takes a field label—which can be defined or modified by a user—and directly concatenates this string into the ORDER BY clause of a generated SQL statement.\nBecause the application fails to implement an allowlist to restrict which fields or column names can be utilized in sorting operations, it provides an injection vector for malicious SQL fragments. The affected component is located within the flow of aor_fields, which handles the selection and ordering of report data.\nAn authenticated attacker initiates the attack by crafting a malicious AOR report request. By supplying an engineered payload as a field label, the attacker can break out of the intended query structure. Since the input is used within an ORDER BY clause, the attacker can leverage blind SQL injection techniques, specifically time-based attacks, to infer data character by character.\nThe attack flow proceeds as follows: First, the attacker identifies or creates a report that utilizes the vulnerable field selection logic. Second, the attacker submits a request where the field label includes SQL functions such as SLEEP() or heavy logical evaluations conditioned on subqueries. Third, the database evaluates these injected expressions. By measuring the server's response time, the attacker can confirm the validity of injected Boolean queries, allowing for the systematic extraction of data from the database schema, including the contents of sensitive tables like those storing user password hashes.\nIn addition to data exfiltration, the vulnerability allows for a denial-of-service attack. By injecting expensive, long-running database operations into the ORDER BY clause, an attacker can consume excessive CPU and I/O resources on the database server. This forces the database to maintain open connections and perform intensive computations, effectively degrading system performance or causing a complete service outage for legitimate users.\nThis vulnerability is present in versions of SuiteCRM prior to 7.15.2 and 8.10.2. While authentication is required, the privilege level required is merely access to the AOR Reports module, which is common for many users in an enterprise CRM environment. The exposure is internal to the application's network perimeter but is critical due to the direct impact on the backend database integrity and confidentiality."
}