Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled data or authorization state into the security-sensitive operation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:23.557Z",
  "pubdate": "2026-11-05T19:17:23.557Z",
  "executiveSummary": "SuiteCRM is susceptible to an authenticated SQL injection vulnerability within its legacy REST API interface. The vulnerability exists due to improper structural validation of user-supplied query parameters before they are appended to SQL WHERE clauses.\nThis flaw allows an authenticated user with basic list permissions on any module to manipulate database queries, bypassing intended security filters such as the user_hash constraint.\nThe primary impact involves unauthorized data exfiltration, specifically the retrieval of sensitive information including password hashes and internal database contents. By compromising administrative credentials, an attacker can achieve full application takeover.\nThe vulnerability affects versions prior to 7.15.2 and 8.10.2. Exploitation requires valid authentication with list permissions and targeting specific legacy REST endpoints. The risk level is critical given the potential for complete system compromise and data exfiltration.",
  "technicalDetails": "The vulnerability originates in the legacy REST architecture of SuiteCRM, specifically within the handling of API requests processed by /service/v4_1/rest.php. The flaw resides in the processing logic for the methods 'get_entry_list', 'get_entries_count', and 'query'.\nRoot Cause Analysis: The application fails to implement sufficient structural validation or parameterization for input data provided via query parameters. When an authenticated user submits a request, the system incorrectly appends this user-controlled input directly into the SQL WHERE clause of the underlying database query. This lack of sanitization allows for the injection of arbitrary SQL syntax.\nExploitation Flow: An attacker begins by authenticating to the SuiteCRM instance using valid credentials that possess list permissions on at least one module. The attacker then targets the /service/v4_1/rest.php endpoint, manipulating the API parameters associated with the 'get_entry_list', 'get_entries_count', or 'query' methods. By crafting a malicious payload, the attacker breaks out of the intended query structure, effectively bypassing the default 'user_hash' security filter that should restrict record access to the current user's scope.\nPayload Behavior: The injected SQL allows the attacker to perform blind or error-based SQL injection, enabling the exfiltration of the entire database contents. Of particular concern is the ability to retrieve stored password hashes from the 'users' table or similar authentication repositories. Once the attacker retrieves the password hashes for administrative accounts, they can perform offline cracking or leverage the recovered credentials to authenticate as a privileged user.\nPost-Exploitation Impact: Successful exploitation leads to full confidentiality loss of the application's database. Furthermore, the escalation to administrative privileges allows the attacker to modify application configurations, execute administrative functions, and potentially achieve remote code execution depending on the server configuration and SuiteCRM's operational environment. The vulnerability effectively nullifies the authorization boundary for REST API consumers, permitting lateral movement across the application's data layer."
}