Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T19:17:26.013Z",
  "pubdate": "2026-11-05T19:17:26.013Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in SuiteCRM versions prior to 7.15.2 and 8.10.2 within the Advanced Open Reporting (AOR) module.\nThe vulnerability stems from improper neutralization of user-controlled input stored in the aor_fields.field database column.\nAn authenticated user with report configuration privileges can manipulate stored field values to inject arbitrary SQL commands during the report generation process.\nThis flaw allows for unauthorized database queries, potentially leading to the full disclosure of sensitive database contents, including credentials, customer PII, and internal application metadata.\nThe risk is categorized as high, as it enables authenticated attackers to bypass security boundaries through stored input manipulation.\nExploitation requires active authentication and specific privileges to configure or modify reports, but once accessed, the attack vector is facilitated by the application's failure to enforce strict input validation or use parameterized queries when concatenating field definitions into SQL statements.",
  "technicalDetails": "The root cause of this vulnerability is the insecure construction of dynamic SQL queries within the AOR (Advanced Open Reporting) module. Specifically, the application logic retrieves configuration values stored in the aor_fields.field column and performs direct string concatenation of these values into the report's SQL command string without adequate sanitization, validation, or the use of prepared statements.\nThe vulnerable component is the AOR report generation engine, which dynamically processes field definitions to render reports for end users. Because the values stored in aor_fields.field are considered trusted once persisted, the application fails to perform input validation at the time of execution, effectively treating stored user input as part of the trusted SQL structure.\nThe exploitation flow begins with an authenticated attacker gaining access to the report configuration interface. The attacker injects malicious SQL fragments into the field configuration parameters stored within aor_fields.field. Upon the execution or preview of a report utilizing these modified fields, the backend engine processes the concatenated query string.\nBecause the input is not parameterized, the database interprets the attacker's injected SQL fragments as part of the legitimate query. For example, by inserting a UNION SELECT or similar subquery, the attacker can force the application to return unintended data sets, including contents from sensitive tables such as users, passwords (if stored in plain text or reversible formats), or third-party configuration data.\nThis vulnerability is classified as an authenticated SQL injection (SQLi). It necessitates a valid user session with sufficient privileges to interact with report configuration settings. However, it does not require administrative access beyond that which is required to modify existing reports. The network exposure is limited to the web interface where the CRM is deployed, but the post-exploitation impact is severe, as successful execution permits blind or error-based data exfiltration from the underlying database backend. The reliance on string concatenation rather than parameterized queries is a significant architectural flaw within the AOR module's data retrieval layer."
}