Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:23.750Z",
  "pubdate": "2026-11-05T19:17:23.750Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a critical time-based blind SQL injection vulnerability within the REST API v4.1 get_entry_list method.\nThis vulnerability allows an authenticated attacker to perform unauthorized database queries, potentially leading to full data exfiltration.\nExploitation requires the attacker to bypass two independent security controls concurrently, though the specific mechanisms are not detailed in the advisory.\nThe vulnerability poses a severe risk to confidentiality, as successful exploitation enables the extraction of sensitive information through inference based on server response latency.\nThe vulnerability is limited to authenticated users; however, once inside the application, an attacker with valid credentials can leverage this flaw to interact directly with the underlying database management system.\nThe issue is fully remediated in the updated versions 7.15.2 and 8.10.2.",
  "technicalDetails": "The vulnerability resides in the get_entry_list function of the SuiteCRM REST API v4.1, which fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries.\nAs a time-based blind SQL injection, the flaw allows an attacker to manipulate the execution flow of backend database queries. By injecting conditional SQL statements that utilize time-delay functions (such as SLEEP() or its equivalent depending on the database driver), the attacker can infer information bit-by-bit based on the time taken for the server to return a response.\nExploitation is contingent upon the concurrent bypass of two distinct security mechanisms implemented within the application. While the specific nature of these controls is unspecified, their bypass indicates a failure in defense-in-depth where multiple layers of security are simultaneously invalidated or misconfigured by the attacker's request parameters.\nThe attack flow proceeds as follows: An authenticated user transmits a specially crafted request to the get_entry_list API endpoint. This request includes malicious SQL fragments within the input parameters that are intended to bypass existing filters. Upon successful bypass of the security controls, the underlying application logic processes these fragments directly into a database query string. The database then executes the injected conditional logic. If the condition is met, the database is instructed to pause execution for a specified duration, creating a detectable latency in the API response. By iterating this process with binary search techniques, the attacker can systematically extract the contents of database tables, such as credentials, user data, or configuration settings.\nThis vulnerability is particularly dangerous because it does not rely on error-based feedback, allowing it to function even when direct database errors are suppressed or not returned in the API response.\nThe affected component is the REST API interface, which provides a programmatic bridge between external clients and the internal data layer. The vulnerability persists until the aforementioned patches are applied, which introduce rigorous input validation and parameterized query structures to neutralize the injection vector."
}