CVE-2026-61653
Undergoing Analysis Undergoing Analysis - In Progress

SQL Injection in SuiteCRM via Campaigns Module

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: GitHub, Inc.

Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-61653
EUVD
EUVD-2026-117655

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have a SQL injection flaw in modules/Campaigns/PopupCampaignRoi.php. The $_REQUEST['id'] parameter is directly used in SQL queries without proper sanitization. An attacker can bypass the securexss() filter by prefixing an XSS payload, allowing a literal quote to reach the query. This enables time-based blind SQL injection for authenticated users with Campaigns access.

Detection Guidance

Check SuiteCRM version with: grep "version" config.php. If version is below 7.15.2 or 8.10.2, the system is vulnerable. Inspect modules/Campaigns/PopupCampaignRoi.php for direct use of $_REQUEST['id'] in SQL queries.

Monitor database logs for unusual time-based queries or errors from Campaigns module access. Test with authenticated requests containing XSS payloads to see if SQL errors or delays occur.

Impact Analysis

An authenticated user with Campaigns module access could exploit this to extract sensitive data from any database table via time-based blind SQL injection. This may lead to unauthorized data access, data breaches, or further system compromise depending on the database contents.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade SuiteCRM to version 7.15.2 or 8.10.2 immediately. If upgrading is not possible, restrict access to the Campaigns module for non-admin users and monitor database activity closely.

Apply input validation to $_REQUEST['id'] in modules/Campaigns/PopupCampaignRoi.php to prevent SQL injection. Review and update WAF rules to block suspicious queries targeting this module.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...