Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. The affected flow begins at $GLOBALS['RAW_REQUEST'] and uses set_relationship, SugarRelationship::addRow(), SugarRelationship::updateRow(), and contact_role to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can inject SQL through relationship fields to read or alter database data and may reach file-write consequences when the database account has elevated privileges. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:24.533Z",
  "pubdate": "2026-11-05T19:17:24.533Z",
  "executiveSummary": "SuiteCRM is susceptible to an authenticated SQL injection vulnerability within its REST v4 JSON handler. The vulnerability stems from improper neutralization of user-supplied data that is subsequently interpolated into database queries.\nThe flaw allows an authenticated attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification, or, in scenarios where the database service account possesses elevated permissions, remote file system interaction.\nThis vulnerability affects versions of SuiteCRM prior to 7.15.2 and 8.10.2. The security risk is high, as it grants attackers the ability to compromise the integrity and confidentiality of the CRM database and potentially the underlying host environment.\nExploitation requires the attacker to possess valid authentication credentials to interact with the vulnerable REST API endpoints. Once authenticated, the attacker can leverage the relationship management functions to manipulate backend SQL statements through crafted payloads.",
  "technicalDetails": "The vulnerability resides in the REST v4 JSON handler, which improperly handles input from the pre-filter RAW_REQUEST global variable. Specifically, the logic within set_relationship and associated helper functions, such as SugarRelationship::addRow() and SugarRelationship::updateRow(), fails to adequately sanitize or parameterize user-supplied field values before embedding them into INSERT and UPDATE SQL statements.\nThe attack vector involves targeting the relationship management features of the application, including the contact_role module. An attacker initiates the exploitation process by sending a crafted request to the REST v4 interface. The attacker-controlled data, injected via these relationship fields, traverses the application's backend logic without sufficient validation or encoding, allowing for the termination of legitimate query strings and the injection of malicious SQL syntax.\nThe root cause is the reliance on insecure string interpolation within database interaction layers rather than utilizing prepared statements or parameterized queries. Because the application logic processes these inputs in a security-sensitive context, the injected commands are executed by the database engine with the privileges assigned to the SuiteCRM database user.\nThe impact of successful exploitation is broad. In a standard scenario, an attacker can perform blind or union-based SQL injection to extract sensitive customer information, modify record states, or bypass authorization checks. Furthermore, if the database configuration permits interaction with the host operating system—such as the ability to read or write files via functions like LOAD_FILE or INTO OUTFILE—an attacker can potentially achieve remote file-write consequences. This escalation could allow for the deployment of webshells or the modification of sensitive configuration files, leading to full application compromise or remote code execution depending on the database user's privileges and system hardening status."
}