CVE-2025-54788: SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54788?
CVE-2025-54788 is a critical vulnerability due to its potential for SQL injection, allowing unauthorized access and manipulation of the backend database.
How do I fix CVE-2025-54788?
To remediate CVE-2025-54788, upgrade your SuiteCRM instance to version 7.14.8 or later where the vulnerability has been patched.
What versions are affected by CVE-2025-54788?
CVE-2025-54788 affects SuiteCRM versions up to and including 7.14.7.
What are the potential impacts of CVE-2025-54788?
The impacts of CVE-2025-54788 include unauthorized data access, database manipulation, and the potential for full system compromise.
Is CVE-2025-54788 being actively exploited?
As of now, there have been indications of CVE-2025-54788 being actively targeted, highlighting the urgency to apply the necessary updates.