CVE-2026-61651: SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged SuiteCRM user can exploit it. No user interaction is required, and the vulnerable action is reachable over the network.
Which SuiteCRM versions need remediation?
SuiteCRM versions earlier than 7.15.2 and earlier than 8.10.2 are affected. Upgrade to 7.15.2 or 8.10.2, as applicable.
What could an attacker obtain through exploitation?
An attacker can use blind SQL injection to enumerate the database schema and extract database contents, including credentials and customer records. The issue can also affect data integrity.