Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linked_documents records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:25.313Z",
  "pubdate": "2026-11-05T19:17:25.313Z",
  "executiveSummary": "This vulnerability is an SQL injection flaw identified in SuiteCRM, affecting versions prior to 7.15.2 and 8.10.2. The vulnerability exists within the GetLatestRevision.php file, where user-supplied input is improperly sanitized before being incorporated into a database UPDATE query.\nBy bypassing the AntiXSS encoding mechanisms through a specifically crafted input payload, an authenticated, low-privileged user with access to the Documents module can inject malicious SQL characters into the application's backend queries. This allows the attacker to manipulate data within the linked_documents records and potentially disclose database content.\nThe risk is significant as it permits unauthorized data modification and sensitive information disclosure. Although the exploit does not support stacked queries or destructive operations like DROP or INSERT, the ability to influence data integrity within an enterprise CRM platform poses a substantial security risk to organizational data. Successful exploitation requires an authenticated session with specific module-level privileges, limiting the initial attack surface to existing users but providing a vector for privilege escalation or unauthorized data access.",
  "technicalDetails": "The vulnerability resides in the GetLatestRevision.php component of SuiteCRM, specifically within the handling of the get_latest_for_id parameter. The application utilizes a flawed sanitation workflow where the securexss() function is intended to mitigate malicious input by performing entity encoding on quote characters. However, the logic contains a critical bypass condition regarding the AntiXSS processing engine.\nThe exploitation mechanism relies on the way the application processes nested sanitization filters. When an input string is prefixed with an XSS payload, the AntiXSS logic erroneously selects a processed, unencoded version of the string instead of defaulting to the secure, entity-encoded backup. This logic error allows literal quote characters to bypass the intended security controls and reach the underlying SQL UPDATE statement directly.\nThe attack flow proceeds as follows: First, an attacker authenticated as a low-privileged user must access the Documents module. Second, the attacker crafts a malicious request containing a specially formatted payload targeting the get_latest_for_id variable. Third, the crafted input causes the AntiXSS routine to fail, injecting a quote character into the query context of the SQL execution. Finally, the database executes the modified query, allowing the attacker to perform unauthorized updates to records in the linked_documents table or perform data exfiltration via error-based or blind injection techniques.\nThis vulnerability is classified as an SQL injection (SQLi) because the application fails to utilize parameterized queries or prepared statements when interacting with the database. The root cause is the reliance on a flawed client-side/application-layer sanitization library rather than robust server-side input validation and query abstraction. While the vulnerability does not support stacked SQL statements, preventing the execution of arbitrary commands like INSERT or DROP, the impact remains severe due to the ability to modify internal documentation links and retrieve sensitive record data. Affected versions include all SuiteCRM instances prior to 7.15.2 and 8.10.2. The vulnerability is network-exposed as it is accessible through standard web interface interactions requiring only basic, authenticated module-level access."
}