Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database information or abuse the UPDATE context to soft-delete all records in the notes table in one request. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T19:17:24.977Z",
  "pubdate": "2026-11-05T19:17:24.977Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 contain a critical SQL injection vulnerability within the email template attachment handling module.\nThe vulnerability allows an authenticated attacker to manipulate database queries by injecting malicious SQL code through the remove_attachment POST parameter.\nThis flaw stems from improper sanitization and direct interpolation of user-supplied data into SQL UPDATE statements after incomplete processing via securexss().\nAn attacker can leverage this vulnerability to perform unauthorized database operations, including the exfiltration of sensitive information or the mass deletion of records from the notes table.\nThe vulnerability is exploitable by authenticated users, posing a significant risk to data integrity and confidentiality.\nSuccessful exploitation requires the attacker to have an active session within the application, and the lack of robust parameter binding or input validation facilitates this attack vector.\nOrganizations using affected versions of SuiteCRM are at risk of data loss and database compromise until the application is updated to the patched versions.",
  "technicalDetails": "The vulnerability exists in the email template management logic where the remove_attachment parameter array is processed for attachment removal.\nThe root cause is identified as the incorrect application of the securexss() function, which is designed to prevent Cross-Site Scripting (XSS) rather than SQL Injection (SQLi), followed by the direct interpolation of these array elements into an SQL UPDATE statement without parameterization.\nBecause securexss() does not mitigate SQL injection threats, the application remains susceptible to query manipulation. When the backend constructs the SQL command, user-supplied content within the remove_attachment array is treated as part of the query structure rather than literal data.\nAn authenticated attacker can craft a malicious payload within the remove_attachment POST parameter. By injecting SQL syntax such as single quotes or comment delimiters, the attacker can break out of the intended query context.\nThe exploit allows for the execution of arbitrary SQL commands against the database. For example, an attacker can manipulate the WHERE clause of the UPDATE statement to target unintended rows. Specifically, an attacker could abuse the update context to perform a batch soft-delete operation, effectively marking all records in the notes table as deleted in a single request.\nFurthermore, the injection point allows for Boolean-based or time-based blind SQL injection techniques, enabling the attacker to infer the contents of the database or extract information schema metadata.\nThis vulnerability is reachable by any user authenticated to the SuiteCRM instance who has the privileges to access email template functionality. No specialized knowledge beyond standard SQL injection techniques is required to abuse the insecure implementation.\nThe attack flow begins with the submission of a crafted HTTP POST request to the endpoint responsible for removing attachments from email templates. The request includes the manipulated remove_attachment array. The application incorrectly processes this input, passes it to the database driver, and executes the tainted SQL command. The database engine then processes the injected logic, leading to unauthorized modification or data exposure."
}