SQL Injection in SuiteCRM via Documents Module

Executive Summary

SuiteCRM versions before 7.15.2 and 8.10.2 have a SQL injection flaw in GetLatestRevision.php. The get_latest_for_id parameter is directly inserted into an SQL UPDATE query without proper sanitization. An attacker can bypass the securexss() filter by prefixing an XSS payload, allowing a literal quote to reach the database. This enables low-privileged users with Documents module access to read sensitive data or update linked_documents records.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SuiteCRM versions prior to 7.15.2 and 8.10.2. Inspect modules/Documents/GetLatestRevision.php for direct SQL parameter interpolation. Monitor database logs for unusual UPDATE queries on linked_documents or time-based blind SQL patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could extract sensitive data from any database table via time-based blind SQL injection, leak credentials into server logs, or cause partial denial-of-service by delaying responses with SLEEP payloads. They can also mass-update linked_documents records but cannot execute multi-statement commands like DROP or INSERT.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. Organizations using vulnerable versions risk non-compliance and potential regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SuiteCRM to versions 7.15.2 or 8.10.2 or later. Restrict Documents module access to trusted users. Review database logs for signs of exploitation. Apply input validation and parameterized queries to prevent SQL injection.

Useful 0 Not Useful 0