Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:25.660Z",
  "pubdate": "2026-11-05T19:17:25.660Z",
  "executiveSummary": "This vulnerability is classified as an SQL injection (SQLi) flaw within the SuiteCRM application, specifically located in the jjwg_Maps module. It allows an authenticated attacker to manipulate backend database queries by injecting malicious SQL statements through the map_markers action.\nThe vulnerability arises from the failure to perform strict numeric validation or proper parameterization on the 'distance' parameter supplied by the caller.\nSuccessful exploitation of this flaw can result in unauthorized data extraction, modification of query results, and potential resource exhaustion via denial-of-service vectors.\nThe scope of impact includes all instances of SuiteCRM prior to versions 7.15.2 and 8.10.2. Because the vulnerability exists within an authenticated endpoint, an attacker must possess a valid user account to initiate the attack. However, the potential for data exfiltration and integrity compromise represents a critical security risk for enterprise environments relying on this CRM software.\nOrganizations using affected versions of SuiteCRM are strongly advised to upgrade to the patched versions to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the jjwg_Maps component of SuiteCRM, specifically within the map_markers action. The root cause of this SQL injection is the improper handling of user-supplied input for the 'distance' parameter.\nWhen a request is made to the map_markers action, the application takes the 'distance' value provided by the authenticated caller and incorporates it directly into a SQL query executed against the underlying database. The application fails to apply strict numeric validation, which would ensure the input contains only expected characters, and it fails to utilize parameterized queries or prepared statements to separate the command logic from the data.\nAn attacker can exploit this by supplying a crafted string instead of a valid numeric value for the distance parameter. This string can contain SQL control characters, such as single quotes, semicolons, or SQL keywords like 'UNION', 'SELECT', 'OR', or 'AND'.\nThe exploitation flow proceeds as follows: First, the attacker authenticates to the SuiteCRM instance. Second, the attacker triggers an HTTP request to the vulnerable map_markers endpoint, injecting malicious SQL syntax into the 'distance' parameter. Third, the backend application server concatenates this malicious input directly into the SQL query buffer. Fourth, the database engine interprets the injected syntax as part of the intended query structure, thereby executing unintended commands with the privileges of the database user configured for the CRM application.\nThe impact of this injection allows an attacker to manipulate the query structure to bypass intended data access controls. This enables the extraction of sensitive information from other database tables via UNION-based attacks, the alteration of query results to facilitate unauthorized logic flows, or the execution of heavy queries to induce resource exhaustion, thereby impacting availability. The vulnerability affects all versions of SuiteCRM prior to 7.15.2 and 8.10.2."
}