Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:22.203Z",
  "pubdate": "2026-11-05T19:17:22.203Z",
  "executiveSummary": "SuiteCRM is susceptible to a critical SQL injection vulnerability arising from improper input sanitization within the AOR Reports module.\nThis vulnerability allows authenticated, low-privileged users to execute arbitrary SQL queries against the underlying database.\nThe flaw stems from a logic error in how user-supplied inputs are processed by the unencodeMultienum() function and the AntiXSS security wrapper.\nBy manipulating the Multi report condition parameter, an attacker can bypass quote-encoding mechanisms to inject malicious SQL commands.\nSuccessful exploitation permits unauthorized data exfiltration, including access to sensitive tables, and potential denial-of-service through resource exhaustion.\nThe attack is mitigated in versions 7.15.2 and 8.10.2, and immediate patching is required for all affected instances.",
  "technicalDetails": "The vulnerability resides in the processing of the 'parameter_value' input within the SuiteCRM Multi report condition functionality. The root cause is a breakdown in the data sanitization pipeline where an interaction between the unencodeMultienum() function and the AntiXSS utility leads to the injection of literal single quotes into the SQL context.\nTypically, the securexss() function is designed to prevent Cross-Site Scripting by entity-encoding quotes. However, the system contains a flawed logic check: when an input is prefixed with an XSS payload, the AntiXSS mechanism incorrectly selects a processed string instead of the secure, encoded backup. This oversight effectively bypasses the intended security control, allowing an unencoded, literal quote to persist into the final SQL construction.\nThe attack flow proceeds as follows: An authenticated user with access to AOR Reports constructs a specially crafted 'parameter_value' that incorporates an XSS-like prefix. This prefix triggers the vulnerable AntiXSS conditional branch, causing the application to treat the subsequent input as trusted. The malicious payload is then concatenated directly into the WHERE clause of a SQL query without parameterization or proper neutralization of SQL metacharacters.\nExploitation methods include time-based blind SQL injection and UNION-based exfiltration. Because the application processes these queries against the backend database, an attacker can extract data from any table accessible to the database user. Furthermore, the ability to inject custom SQL allows for the insertion of delay expressions (e.g., SLEEP or BENCHMARK functions), which can lead to database connection pool exhaustion and denial-of-service.\nThis vulnerability affects all SuiteCRM versions prior to 7.15.2 and 8.10.2. It requires an authenticated user with low-level privileges (AOR Reports access). No network-level bypasses are required beyond standard application access, as the vulnerability is situated within the application's internal request processing logic."
}