SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…iteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf Diğer
• github.com/…ommit/a11f50180d939f639cc468b5d536e8ad714dfb68 Diğer
• github.com/…ommit/d6bca97a0159ec019a969b86eca32affab3beb7c Diğer
• github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 Diğer
• github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 Diğer

Kayıt geçmişi

1. 5 Kas 2026 21:27Yayımlandı

İlgili açıklar

• 9,4 CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
• 8,8 CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
• 6,5 CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date function
• 6,9 CVE-2026-100362SuiteCRM: V8 OAuth2 Username Enumeration
• 8,8 CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
• 7,1 CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record