CVE-2022-50589

CriticalCVSS 9.8

Published: 06/11/2025(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

46th percentile - higher than 46% of all known CVEs

Summary

A SQL injection vulnerability in SuiteCRM versions prior to 7.12.6 exists in the processing of the 'uid' parameter within the export functionality. Remote unauthenticated attackers can exploit this flaw to execute arbitrary code.

Risk Assessment

The risk for the organization includes unauthorized database access and remote code execution, potentially leading to full system compromise and data breach.

Recommendation

Immediately upgrade SuiteCRM to version 7.12.6 or later and implement input validation for the 'uid' parameter.

Original NVD description (English source)

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.