SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…iteCRM/security/advisories/GHSA-5m7h-v4v6-2r8h Diğer
• github.com/…ommit/a11f50180d939f639cc468b5d536e8ad714dfb68 Diğer
• github.com/…ommit/d6bca97a0159ec019a969b86eca32affab3beb7c Diğer
• github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 Diğer
• github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 Diğer

Kayıt geçmişi

1. 5 Kas 2026 21:18Yayımlandı

İlgili açıklar

• 9,4 CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
• 8,8 CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
• 6,5 CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date function
• 6,9 CVE-2026-100362SuiteCRM: V8 OAuth2 Username Enumeration
• 8,8 CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
• 7,1 CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record