Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:22.737Z",
  "pubdate": "2026-11-05T19:17:22.737Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a critical blind SQL injection vulnerability within the Projects Controller.\nThe vulnerability resides in the get_end_date action, which fails to properly sanitize the task_id parameter before including it in a backend SQL query.\nThis flaw allows an authenticated user to perform unauthorized database operations, including schema enumeration and the exfiltration of sensitive data such as customer records and authentication credentials.\nThe vulnerability poses a severe risk to confidentiality and integrity, as it enables low-privileged attackers to bypass application-level access controls to query the underlying database directly.\nExploitation requires a valid user account, but it does not necessitate elevated administrative privileges, making it a significant threat to enterprise data security.\nOrganizations using affected versions of SuiteCRM should prioritize patching to the identified secure releases immediately to mitigate the risk of data compromise.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the Projects Controller of the SuiteCRM application, specifically within the get_end_date action.\nThe root cause is the insecure construction of database queries where the input parameter task_id is concatenated directly into the SQL statement without the use of prepared statements or parameterized queries.\nBy manipulating the task_id input, an attacker can append malicious SQL syntax to the original query executed by the application.\nThe vulnerability is categorized as a blind SQL injection, meaning the application does not return the results of the query directly in the HTTP response body. Instead, attackers must infer data by observing differences in application behavior, such as timing delays or variations in HTTP response content, based on true/false conditions injected into the query.\nAn authenticated low-privileged user can leverage this capability to systematically map the database schema by querying metadata tables (e.g., information_schema in MySQL). Once the schema is understood, the attacker can craft further queries to extract sensitive contents from tables such as those containing user credentials, session tokens, or private customer information.\nThe attack flow follows a structured pattern: 1) The attacker intercepts or crafts an HTTP request targeting the get_end_date action; 2) The attacker modifies the task_id value to include SQL payloads (e.g., using UNION-based or time-based techniques); 3) The server-side code executes the tainted query against the database; 4) The database processes the malicious commands; 5) The attacker analyzes the server's response to extract information one bit at a time.\nThis vulnerability is present in all versions of SuiteCRM prior to 7.15.2 and 8.10.2. The lack of input sanitization and the reliance on string concatenation for dynamic query building within the application's controller logic constitutes the primary security failure.\nPost-exploitation, the impact is significant, potentially leading to a full compromise of the database contents, lateral movement within the environment, and unauthorized access to protected business information."
}