Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T19:17:24.753Z",
  "pubdate": "2026-11-05T19:17:24.753Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the Project module of SuiteCRM prior to versions 7.15.2 and 8.10.2. The vulnerability stems from improper input validation of the 'duplicateId' POST parameter, which is concatenated directly into SQL queries without sanitization or parameterization.\nThis flaw allows an authenticated attacker to manipulate the backend query structure, potentially leading to unauthorized disclosure of sensitive database information. Given the nature of CRM software, this could expose customer records, authentication credentials, and proprietary business data.\nThe vulnerability requires the attacker to have an active authenticated session within the application. Once authenticated, the attacker can supply malicious SQL syntax via the 'duplicateId' parameter to bypass application logic and interact directly with the underlying database management system. The risk is significant as it grants attackers the ability to query the database beyond the intended scope of the Project module. Organizations using affected versions are strongly advised to upgrade to 7.15.2 or 8.10.2 immediately to remediate this security gap.",
  "technicalDetails": "The vulnerability is classified as an improper neutralization of special elements used in an SQL command, commonly referred to as SQL injection. The root cause is the insecure handling of the 'duplicateId' POST parameter within the Project module's codebase. The application logic fails to employ parameterized queries or prepared statements, instead directly interpolating the user-supplied string into the SQL execution environment.\nThe attack flow begins with an authenticated user initiating a request to the Project module that triggers the vulnerable code path involving the 'duplicateId' parameter. Because the input is not sanitized, an attacker can break out of the intended data context by injecting SQL metacharacters (e.g., single quotes, comment sequences, or boolean operators). By injecting crafted SQL syntax, the attacker can manipulate the WHERE clause or other parts of the statement to alter the query logic entirely.\nExploitation allows the attacker to execute arbitrary SQL commands within the context of the database user configured for the SuiteCRM application. Through techniques such as UNION-based injection or boolean-based blind SQL injection, an attacker can extract sensitive records from various tables within the database schema. This level of access bypasses the application's native access control mechanisms, as the database engine executes the commands as requested by the application's own database service account.\nThe vulnerable component is identified within the Project module of SuiteCRM. The lack of input validation or effective sanitization before query concatenation ensures that any malicious input submitted through the 'duplicateId' field is interpreted as executable code by the database parser. This vulnerability is present in all versions prior to 7.15.2 and 8.10.2.\nPost-exploitation, the impact is severe, ranging from sensitive data exposure to potential further escalation if the database configuration permits additional operations such as stack queries or administrative functions. The necessity of prior authentication limits the exposure to users who already possess valid credentials, though this does not mitigate the risk from malicious insiders or compromised user accounts. The vulnerability is exploitable over the network, making it a critical concern for any internet-facing CRM deployment."
}