BIT-suitecrm-2024-49773

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/suitecrm/BIT-suitecrm-2024-49773.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-suitecrm-2024-49773
Aliases
Published
2024-11-07T07:19:51.087Z
Modified
2025-05-20T10:02:07.006Z
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM
Details

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. current_post parameter in export entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*"
    ]
}
References

Affected packages

Bitnami / suitecrm

Package

Name
suitecrm
Purl
pkg:bitnami/suitecrm

Severity

  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.14.6
Introduced
8.0.0
Fixed
8.7.1

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/suitecrm/BIT-suitecrm-2024-49773.json"