Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:22.937Z",
  "pubdate": "2026-11-05T19:17:22.937Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in SuiteCRM, an open-source, enterprise-ready Customer Relationship Management (CRM) platform. The flaw affects versions prior to 7.15.2 and 8.10.2 and is located within the campaigns processing logic handled by the modules/Campaigns/PopupCampaignRoi.php component.\nThe vulnerability stems from flawed sanitization logic where user-supplied input via the $_REQUEST['id'] parameter is interpolated directly into SQL queries. Although the application utilizes the securexss() function to entity-encode quotation marks, an architectural interaction failure between securexss() and AntiXSS allows an attacker to bypass this mechanism. Supplying an input prefixed with an XSS payload causes AntiXSS to select a processed string instead of the entity-encoded backup, allowing unescaped quotation marks to reach the database query.\nExploitation requires network access and authentication as a user with permissions to the Campaigns module. Successful exploitation enables an attacker to perform time-based blind SQL injection attacks against arbitrary database tables. This poses a significant threat to data confidentiality, as malicious actors can systematically extract sensitive information from the database. The issue has been remediated in SuiteCRM versions 7.15.2 and 8.10.2.",
  "technicalDetails": "The root cause of this vulnerability lies in the input handling and parameter interpolation mechanism within modules/Campaigns/PopupCampaignRoi.php. Specifically, the script accepts user input via the $_REQUEST['id'] parameter and directly interpolates it into a SQL statement without parameterization. Under standard operation, the application relies on the securexss() function to sanitize input by entity-encoding quotes to prevent code and query injection.\nHowever, a logic failure exists in the sanitization pipeline involving the interaction between securexss() and the AntiXSS component. When an incoming parameter value in $_REQUEST['id'] is prefixed with a Cross-Site Scripting (XSS) payload, AntiXSS alters its processing behavior. Instead of returning the entity-encoded backup string prepared by securexss(), AntiXSS returns a processed string that retains literal quotation marks.\nThis behavior creates a complete sanitization bypass. Because the quote characters are left literal and unencoded, the boundary of the SQL query string in modules/Campaigns/PopupCampaignRoi.php is broken upon parameter interpolation. An authenticated attacker who has access to the Campaigns module can craft a specialized payload containing an XSS prefix followed by SQL syntax.\nBecause direct query output may not be rendered directly back to the user interface in this context, the flaw manifests as a time-based blind SQL injection vulnerability. An attacker can inject time-delay SQL functions into the $_REQUEST['id'] parameter, observing server response latency to infer database structure and extract arbitrary data from underlying database tables bit-by-bit.\nThe complete attack execution flow operates as follows:\n1. An authenticated user with Campaigns module access issues an HTTP request targeting modules/Campaigns/PopupCampaignRoi.php.\n2. The attacker crafts the $_REQUEST['id'] parameter to include an initial XSS payload string, followed by a time-based SQL injection payload containing literal single or double quote characters.\n3. The application processes $_REQUEST['id'] through securexss().\n4. Due to the presence of the XSS payload prefix, the AntiXSS component selects the processed string output rather than the entity-encoded fallback.\n5. The sanitized string, still containing literal quotes, is passed into the SQL string construction inside modules/Campaigns/PopupCampaignRoi.php.\n6. The database executes the injected SQL command, allowing the attacker to conduct time-based blind data exfiltration against arbitrary tables.\nThis vulnerability is fully resolved in SuiteCRM versions 7.15.2 and 8.10.2 by correcting parameter handling and sanitization logic."
}