Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:29.280Z",
  "pubdate": "2026-11-05T19:17:29.280Z",
  "executiveSummary": "SuiteCRM versions prior to 7.15.2 and 8.10.2 are susceptible to a blind SQL injection vulnerability within the legacy SOAP portal API.\nThe vulnerability resides in the portal_get_entry_list method, which fails to sanitize user-provided input used in SQL query construction.\nAn authenticated, low-privileged portal API user can exploit this flaw to execute arbitrary SQL queries against the underlying database.\nThe impact includes unauthorized disclosure of database metadata, exposure of sensitive application records, potential modification of query logic, and resource exhaustion via crafted payloads.\nThis vulnerability poses a significant risk to data confidentiality and integrity, as it allows attackers to bypass standard application-level access controls to interact directly with the database backend.\nSuccessful exploitation requires legitimate portal API credentials, limiting the attack surface to authenticated users; however, the elevated risk necessitates immediate patching to secure the application database.",
  "technicalDetails": "The vulnerability is a SQL injection flaw located in the legacy SOAP portal integration of SuiteCRM. Specifically, the portal_get_entry_list method improperly handles the 'where' and 'order_by' parameters provided by the caller.\nThe root cause is the lack of robust input neutralization before these parameters are concatenated into SQL queries. The application fails to employ parameterized queries or adequate escaping mechanisms, allowing the injected SQL syntax to be parsed and executed by the database management system.\nAttack flow involves the following steps: An attacker authenticates as a low-privileged portal user. The attacker then invokes the portal_get_entry_list SOAP method, crafting a malicious request body where the 'where' or 'order_by' arguments contain SQL injection payloads.\nSince the application processes these strings directly within its query logic, the injected SQL commands are executed in the context of the application's database user. Because this is a blind SQL injection vulnerability, an attacker typically utilizes boolean-based or time-based inference techniques to extract data.\nIn a boolean-based attack, the attacker observes differences in the SOAP response (e.g., changes in the returned entry list count or specific error messages) to determine if a logical query condition is true or false. In a time-based attack, the attacker injects functions like SLEEP() or BENCHMARK() to force the server to respond with a delay if a condition is met, confirming the validity of the injected query.\nThe scope of impact is extensive: attackers can enumerate table names, extract user credentials, access customer PII (Personally Identifiable Information), and potentially disrupt system performance. By altering the 'where' clause, an attacker can bypass row-level filtering to retrieve records that they are not authorized to view. The inability to neutralize these input vectors represents a critical failure in the application's data access layer, specifically within the SOAP protocol handlers.\nAffected versions include all SuiteCRM instances prior to 7.15.2 and 8.10.2. The vulnerability is exploitable via the network interface exposed for SOAP API operations, requiring a valid session or authentication token to reach the vulnerable function."
}