- Description
- SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection vulnerability exists in the SuiteCRM authentication mechanisms when directory support is enabled. The application fails to properly sanitize the user-supplied username before using it in a local database query. An attacker with valid, low-privilege directory credentials can exploit this to execute arbitrary SQL commands, leading to complete privilege escalation (e.g., logging in as the CRM Administrator). Versions 7.15.1 and 8.9.3 patch the issue.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
- Products
- suitecrm
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- security-advisories@github.com
- CWE-89
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73648654-E7F6-47CF-8E01-19BBFF737C99",
"versionEndExcluding": "7.15.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C7E15DD3-A934-40A2-8B43-ABCCBB53CBCF",
"versionEndExcluding": "8.9.3",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]