CVE-2022-50589: SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality
SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.12.6
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50589?
CVE-2022-50589 is classified as a critical SQL injection vulnerability.
How do I fix CVE-2022-50589?
To fix CVE-2022-50589, upgrade SuiteCRM to version 7.12.6 or later.
What can attackers do with CVE-2022-50589?
Exploitation of CVE-2022-50589 allows attackers to execute arbitrary code remotely.
Which versions of SuiteCRM are affected by CVE-2022-50589?
All SuiteCRM versions prior to 7.12.6 are affected by CVE-2022-50589.
Is authentication required to exploit CVE-2022-50589?
No, exploitation of CVE-2022-50589 can be performed by remote unauthenticated attackers.