CVE-2022-50589
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A SQL injection vulnerability in SuiteCRM versions prior to 7.12.6 exists in the processing of the 'uid' parameter within the export functionality. Remote unauthenticated attackers can exploit this flaw to execute arbitrary code.
Risk Assessment
The risk for the organization includes unauthorized database access and remote code execution, potentially leading to full system compromise and data breach.
Recommendation
Immediately upgrade SuiteCRM to version 7.12.6 or later and implement input validation for the 'uid' parameter.
Other vulnerabilities in SuiteCRM
See all- CVE-2015-5948High
A race condition in SuiteCRM before version 7.2.3 allows remote attackers to execute arbitrary code. This vulnerability exists due to an incomplete fix for CVE-2015-5947.
- CVE-2015-5947High
SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
- CVE-2015-5946High
An incomplete blacklist vulnerability in SuiteCRM version 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
- CVE-2019-25664High
SuiteCRM 7.10.7 has a time-based SQL injection vulnerability in the record parameter of the Users module DetailView, allowing authenticated attackers to extract data via blind SQL injection.
- CVE-2019-25663High
SuiteCRM 7.10.7 has an SQL injection vulnerability via the parentTab parameter in the email module, allowing authenticated attackers to extract data via boolean-based blind SQL injection.
- CVE-2022-50590Medium
A type confusion vulnerability in SuiteCRM prior to version 7.12.6 occurs during processing of the 'module' parameter in the 'deleteAttachment' functionality. A remote unauthenticated attacker can alter database objects, including changing the administrator's email address.
Original NVD description (English source)
SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.