CVE-2024-49773: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. currentpost parameter in export entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49773?
CVE-2024-49773 is rated as a critical vulnerability due to its potential for SQL injection attacks on SuiteCRM.
How do I fix CVE-2024-49773?
To mitigate CVE-2024-49773, update SuiteCRM to version 7.14.6 or later, or version 8.7.1 or later.
What is the impact of CVE-2024-49773 on SuiteCRM?
CVE-2024-49773 allows authenticated users to execute unauthorized SQL queries, potentially compromising the database.
Who is affected by CVE-2024-49773?
Users of SuiteCRM versions prior to 7.14.6 and versions between 8.0.0 and 8.7.1 are affected by CVE-2024-49773.
Is there a workaround for CVE-2024-49773?
There are no recommended workarounds for CVE-2024-49773 other than upgrading to a patched version of SuiteCRM.