CVE-2025-64488: SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious callid that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64488?
CVE-2025-64488 has a critical severity rating due to its potential to execute arbitrary SQL queries.
How do I fix CVE-2025-64488?
To mitigate CVE-2025-64488, upgrade SuiteCRM to version 7.14.8 or later, or any version above 8.9.0.
Which versions of SuiteCRM are affected by CVE-2025-64488?
CVE-2025-64488 affects SuiteCRM versions 7.14.7 and below, as well as versions between 8.0.0-beta.1 and 8.9.0.
What kind of attacks are possible with CVE-2025-64488?
An attacker can exploit CVE-2025-64488 by crafting a malicious call_id to alter SQL query logic or inject arbitrary SQL code.
Is CVE-2025-64488 related to SQL injection vulnerabilities?
Yes, CVE-2025-64488 is directly related to SQL injection vulnerabilities, allowing attackers to manipulate SQL queries.