CVE-2025-64492: SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. It is possible for an attacker to enumerate database, table, and column names, extract sensitive data, or escalate privileges. This is fixed in version 8.9.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64492?
CVE-2025-64492 has a high severity rating due to its potential for data exfiltration through time-based blind SQL injection.
How do I fix CVE-2025-64492?
To fix CVE-2025-64492, upgrade to SuiteCRM version 8.9.1 or later, which addresses the vulnerability.
Who is affected by CVE-2025-64492?
CVE-2025-64492 affects all versions of SuiteCRM up to and including 8.9.0.
What type of vulnerability is CVE-2025-64492?
CVE-2025-64492 is classified as a time-based blind SQL injection vulnerability.
Can CVE-2025-64492 be exploited remotely?
CVE-2025-64492 requires authentication, but it allows an attacker to exploit the vulnerability once logged in.