Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can include users.user_hash, OAuth2 tokens, CRM records, report definitions, and configuration data; the connector does not permit stacked queries, so direct write-through-injection is not supported. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:26.183Z",
  "pubdate": "2026-11-05T19:17:26.183Z",
  "executiveSummary": "This vulnerability is an SQL injection flaw identified in SuiteCRM versions prior to 7.15.2 and 8.10.2. The security defect resides within the AOR_Report::build_report_query_where function, which fails to adequately sanitize user-supplied input when the parameter_value field type is utilized. An authenticated user with permissions to modify reports can manipulate this field to inject arbitrary SQL commands.\nThe impact of this vulnerability is significant, as it allows unauthorized access to the entire underlying database. An attacker can exfiltrate sensitive data, including password hashes (user_hash), OAuth2 tokens, proprietary CRM records, and global configuration data. While the database connector limits the attack to non-stacked queries, the capacity for data exfiltration poses a severe risk to information confidentiality. Successful exploitation requires an authenticated session with report-saving privileges. The vulnerability has been remediated in the specified patched versions, which implement necessary input validation and query parameterization to prevent injection attacks.",
  "technicalDetails": "The root cause of this SQL injection vulnerability is improper input validation within the AOR_Report::build_report_query_where function. During the report generation process, specifically when the value_type is set to 'Field', the application takes the 'parameter_value' provided by the report editor and incorporates it directly into the SQL query construction without implementing adequate sanitization or parameterized queries.\nThe attack flow initiates when an authenticated user, possessing the requisite privileges to create or edit reports, navigates to the report building interface. By manipulating the 'parameter_value' input field, the attacker can break out of the intended SQL context. By injecting malicious SQL syntax, the attacker forces the database to execute arbitrary queries under the context of the CRM's database user. Because the application utilizes this function to build query WHERE clauses, the attacker can append subqueries or UNION statements to extract unauthorized information from other tables within the database schema.\nThe affected component is the Advanced OpenReport (AOR) module of SuiteCRM. The vulnerability manifests because the dynamic construction of the SQL statement does not account for untrusted input being passed into the query builder. While the backend database connector lacks support for stacked queries, which prevents destructive actions such as table dropping or bulk write modifications via multi-statement injection, the vulnerability remains fully exploitable for read-only data extraction (SELECT-based SQL injection).\nPost-exploitation impact includes the full compromise of data confidentiality. Since the SuiteCRM database often contains the complete ecosystem of user accounts, the exposure of 'user_hash' values allows for offline brute-force attacks against user passwords. Furthermore, the theft of OAuth2 tokens grants the attacker the ability to impersonate legitimate users or applications, potentially leading to privilege escalation or lateral movement within integrated services. The disclosure of configuration data may also provide internal path information or secondary credentials that further jeopardize the integrity of the hosting server environment. This vulnerability affects all SuiteCRM versions prior to 7.15.2 and 8.10.2, and exploitation is strictly limited to authenticated users who possess access to the reporting engine."
}