Blind SQL Injection in SuiteCRM Prior to 7.15.2 and 8.10.2

Executive Summary

SuiteCRM has an authenticated SQL injection vulnerability in its Project Template module. The function action_get_end_date directly interpolates user-controlled POST parameters task_id and lag into SQL queries without sanitization. This allows any authenticated user to inject malicious SQL and read sensitive database contents like credentials and customer data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuiteCRM versions. Affected versions are below 7.15.2 and 8.10.2. Use commands like grep -r 'action_get_end_date' /path/to/SuiteCRM to search for vulnerable code patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker with any valid user account could extract sensitive data such as user credentials, internal communications, and customer information. They could also perform blind time-based database enumeration and potentially escalate privileges depending on database permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Exposure of customer data and credentials may result in regulatory penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SuiteCRM to versions 7.15.2 or 8.10.2 or later. Remove unnecessary user access to prevent exploitation. Monitor database queries for suspicious activity.

Useful 0 Not Useful 0