CVE-2026-100359: SuiteCRM: Authenticated SQL Injection In action_get_end_date function
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions earlier than 7.15.2 and earlier than 8.10.2 are affected. The vulnerable code is in the Project Template module's action_get_end_date function.
What access does an attacker need?
An attacker needs an authenticated SuiteCRM account. No user interaction is required, and the attacker can supply crafted task_id and lag POST parameters.
What could an attacker obtain?
The issue allows blind SQL injection and can be used to read database contents, including customer data, internal communications, and credentials.
How can the issue be remediated?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, which contain fixes for this issue.