CVE-2026-100365: SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and uses aorfields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions prior to 7.15.2 and 8.10.2 are affected. Exploitation requires an authenticated user that has access to AOR Reports.
What can an attacker do with this issue?
An attacker can use time-based blind SQL injection to extract password hashes and arbitrary database table data. They can also run expensive expressions that hold database connections, affecting availability.
What access does an attacker need?
The attacker needs valid authentication and AOR Reports access. No user interaction is required once that access is available.
What should be done to remediate the issue?
Upgrade to SuiteCRM 7.15.2 or 8.10.2, which contain the fix. The issue is in report generation where stored field labels are incorporated into an ORDER BY clause.