GHSA-pmhw-r27f-w92m: SuiteCRM: Time-Based Blind SQL Injection via REST API
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
SuiteCRMto a version that resolves this vulnerability.Fixed in 8.10.2
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running SuiteCRM versions earlier than 7.15.2 or 8.10.2 are affected if the REST API v4.1 get_entry_list method is available. The advisory does not state whether this method is enabled by default.
What access does an attacker need?
An attacker needs authenticated access to the REST API and must bypass two independent security mechanisms. The advisory does not identify those mechanisms or explain how they can be bypassed.
What is the likely impact of successful exploitation?
Successful exploitation enables time-based blind SQL injection and may allow extraction of sensitive information from the database. The listed impact includes high confidentiality and integrity impact, with low availability impact.
What should be done to remediate the issue?
Upgrade SuiteCRM to version 7.15.2 or 8.10.2. If an immediate upgrade is not possible, the provided information does not specify a validated workaround; limiting authenticated access to the REST API can reduce exposure but is not identified as a complete mitigation.