CVE-2026-69142: SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwgMaps map marker endpoint uses the authenticated caller's distance value in the mapmarkers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
SuiteCRM versions prior to 7.15.2 and 8.10.2 are affected where the jjwg_Maps map marker endpoint is available to authenticated callers.
What access does an attacker need?
An attacker needs an authenticated SuiteCRM account and can exploit the issue remotely without user interaction by supplying a crafted distance value to the map_markers action.
What is the impact of successful exploitation?
An attacker can alter the SQL query, extract database data, modify query results, and consume resources. The reported CVSS vector indicates high confidentiality, integrity, and availability impact.
What should be done to remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2, which contain the fix.