SQL Injection in SuiteCRM via Email Template Attachments

Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have an authenticated SQL injection vulnerability in email template attachment handling. The remove_attachment POST parameter array is processed by the securexss() function, which encodes HTML but not SQL metacharacters. These unsanitized elements are then directly inserted into an SQL UPDATE statement, allowing attackers to inject malicious SQL commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuiteCRM versions. Affected versions are 7.15.1 and below, and 8.10.1 and below. Run commands like 'grep -r "7.15.1" /path/to/SuiteCRM/' or 'grep -r "8.10.1" /path/to/SuiteCRM/' to identify vulnerable installations.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker can exploit this to extract sensitive database information through blind time-based techniques or delete all records in the notes table with a single request. Exploitation requires only a valid user account and no admin privileges.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure or deletion, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions risk non-compliance penalties and data breach liabilities.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuiteCRM to versions 7.15.2 or 8.10.2 immediately. Remove unnecessary user accounts to reduce attack surface. Monitor database activity for unusual UPDATE queries targeting the notes table.

Useful 0 Not Useful 0