Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-11-05T19:17:25.490Z",
  "pubdate": "2026-11-05T19:17:25.490Z",
  "executiveSummary": "A blind SQL injection vulnerability exists in SuiteCRM within the CasesController component.\nThe flaw stems from improper neutralization of user-supplied input when processing Knowledge Base article searches.\nAffected versions include SuiteCRM prior to 7.15.2 and 8.10.2.\nA low-privileged, authenticated attacker with access to the Cases module can exploit this vulnerability to perform unauthorized database queries.\nSuccessful exploitation allows for the extraction of sensitive information stored in the application database via blind SQL injection techniques.\nThe security risk is significant, as it permits lateral movement or data exfiltration without requiring administrative privileges, provided the attacker has basic module access.",
  "technicalDetails": "The vulnerability resides within the action_get_kb_articles method of the CasesController in SuiteCRM. The application fails to properly sanitize user input provided via the $_POST['search'] parameter before incorporating it into a SQL query.\nThe root cause of the flaw is an interaction between the application's input processing logic and its security filtering mechanism. While the securexss() function is designed to perform entity-encoding on quotes to prevent SQL injection and cross-site scripting (XSS), the logic is circumvented when the input is prefixed with an XSS-specific payload.\nSpecifically, the AntiXSS implementation within the application incorrectly favors a processed, non-encoded string over the intended encoded backup when specific payload signatures are detected. This behavior allows literal quote characters—which are essential for breaking out of SQL statement contexts—to bypass the security filter and reach the underlying database query.\nThe vulnerable code interpolates the tainted $_POST['search'] input into a CASE WHEN ... LIKE expression within the SQL WHERE clause. An attacker can leverage this to inject arbitrary SQL fragments, effectively manipulating the query structure.\nThe attack flow begins with an authenticated low-privileged user sending a crafted HTTP POST request to the CasesController. By injecting a payload containing the necessary escape characters and SQL syntax, the attacker can force the database to evaluate Boolean conditions.\nDue to the nature of this vulnerability, it manifests as a blind SQL injection. The attacker can infer information about the database schema or contents by observing differences in the application's response, such as varied search results or content availability in the knowledge base article list, based on whether injected logical conditions return true or false.\nThe impact includes the potential for unauthorized data exfiltration, encompassing sensitive user records, configuration data, or system credentials stored within the application's database. Because the vulnerability is reachable through the Cases module, its exploitability is restricted to authenticated users, though no special administrative roles are required."
}