CVE-2026-61648
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In SuiteCRM prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection.
Risk Assessment
The SQL injection vulnerability allows a low-privileged user to read arbitrary data from the CRM database, including other users' data and configuration, and can exhaust database connections.
Recommendation
Update SuiteCRM to version 7.15.2 or 8.10.2 and restrict access to AOR Reports features for users who do not need them.
Other vulnerabilities in SuiteCRM
See all- CVE-2015-5948High
A race condition in SuiteCRM before version 7.2.3 allows remote attackers to execute arbitrary code. This vulnerability exists due to an incomplete fix for CVE-2015-5947.
- CVE-2015-5947High
SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
- CVE-2015-5946High
An incomplete blacklist vulnerability in SuiteCRM version 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
- CVE-2026-71550Critical
In SuiteCRM before 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. An authenticated user with the WorkFlow role can include executable PHP and achieve server-side code execution.
- CVE-2026-100358Critical
In SuiteCRM before 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom/ that is included on later page loads. An administrator can inject persistent PHP that executes as the web-server account.
- CVE-2022-50589Critical
A SQL injection vulnerability in SuiteCRM versions prior to 7.12.6 exists in the processing of the 'uid' parameter within the export functionality. Remote unauthenticated attackers can exploit this flaw to execute arbitrary code.
- CVE-2026-97377High
In SuiteCRM before 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection.
- CVE-2026-71548High
In SuiteCRM before 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database.
- CVE-2026-69145Medium
In SuiteCRM prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents.
- CVE-2026-69144Medium
In SuiteCRM prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revisions.id. When a revision UUID is submitted with type=Documents, the check targets an empty Documents bean and the revision is served without checking its parent document. A low-privileged authenticated user can download administrator-owned or otherwise protected documents.
Original NVD description (English source)
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS