GHSA-22rh-qc6x-cvgw: SuiteCRM: Authenticated SQL Injection In action_get_end_date function

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.