CVE-2019-25664: SuiteCRM 7.10.7 SQL Injection via record Parameter
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25664?
CVE-2019-25664 is classified as a high severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2019-25664?
To fix CVE-2019-25664, upgrade SuiteCRM to version 7.10.8 or later, which addresses this SQL injection vulnerability.
What versions of SuiteCRM are affected by CVE-2019-25664?
CVE-2019-25664 specifically affects SuiteCRM version 7.10.7.
What type of vulnerability is CVE-2019-25664?
CVE-2019-25664 is a SQL injection vulnerability that allows attackers to manipulate database queries.
Who can exploit CVE-2019-25664?
CVE-2019-25664 can be exploited by authenticated users who have access to the Users module in SuiteCRM.