CVE-2025-64493: SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64493?
CVE-2025-64493 is classified as a critical severity vulnerability due to its potential for unauthorized data extraction.
How do I fix CVE-2025-64493?
To fix CVE-2025-64493, upgrade SuiteCRM to version 8.9.1 or later, where the vulnerability has been patched.
What kind of vulnerability is CVE-2025-64493?
CVE-2025-64493 is an authenticated, blind SQL-injection vulnerability in the GraphQL-API of SuiteCRM.
Which versions of SuiteCRM are affected by CVE-2025-64493?
CVE-2025-64493 affects SuiteCRM versions from 8.6.0 through 8.9.0.
What impact does CVE-2025-64493 have on SuiteCRM users?
CVE-2025-64493 allows attackers to execute time-based SQL injection, potentially leading to unauthorized access to sensitive data.