SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can include users.user_hash, OAuth2 tokens, CRM records, report definitions, and configuration data; the connector does not permit stacked queries, so direct write-through-injection is not supported. This issue is fixed in versions 7.15.2 and 8.10.2.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…iteCRM/security/advisories/GHSA-239h-ffjr-v957 Diğer
• github.com/…ommit/a11f50180d939f639cc468b5d536e8ad714dfb68 Diğer
• github.com/…ommit/d6bca97a0159ec019a969b86eca32affab3beb7c Diğer
• github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2 Diğer
• github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2 Diğer

Kayıt geçmişi

1. 5 Kas 2026 21:37Yayımlandı

İlgili açıklar

• 9,4 CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
• 8,8 CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
• 6,5 CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date function
• 6,9 CVE-2026-100362SuiteCRM: V8 OAuth2 Username Enumeration
• 8,8 CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
• 7,1 CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record