CVE-2026-69141: SuiteCRM: SQL injection via search param in modules/Cases/controller.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged user who has access to the Cases module can exploit it. The attack is network-accessible and does not require user interaction.
Are standard deployments affected?
Deployments running SuiteCRM versions before 7.15.2 or 8.10.2 are affected if users can access the Cases module. Exploitation uses the CasesController action_get_kb_articles search parameter.
What is the impact of successful exploitation?
An attacker can conduct blind SQL injection and extract sensitive information from the database. The provided severity vector also indicates high confidentiality and integrity impact, with low availability impact.
What should be done to remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2. If an immediate upgrade is not possible, restrict low-privileged access to the Cases module to reduce exposure.