GHSA-6c7r-7g6m-29f9: SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and uses aorfields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has access to AOR Reports can exploit the vulnerable report-generation flow. No user interaction is required.
Which deployments are affected?
SuiteCRM versions before 7.15.2 and before 8.10.2 are affected. The vulnerable path is AOR report generation using the aor_fields field label in an ORDER BY clause.
What could exploitation allow?
An attacker can use time-based SQL injection to extract password hashes and arbitrary database table data. They can also run expensive expressions that hold database connections, affecting availability.
How can this be remediated?
Upgrade to SuiteCRM 7.15.2 or 8.10.2, which contain the fix. The fix addresses attacker-controlled field labels being concatenated into the ORDER BY clause without an allowlist.