CVE-2026-100365 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's AOR report generator puts a stored field label into an ORDER BY clause without an allowlist. An authenticated user with AOR Reports access can run time-based SQL injection to pull password hashes and other table data.
first public Oct 12, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running SuiteCRM self-hosted where users hold AOR Reports access. The flaw needs an authenticated account with that module; installs where only trusted staff can log in or AOR Reports is restricted are at lower risk. Hosted SaaS deployments depend on the vendor's patching.
Not affected if aor-reports-disabled, managed-hosting, no-untrusted-accounts
Who cares mysql, php, self-hosted, suitecrm
7.15.2 on the 7.x line and before 8.10.2 on the 8.x line are affected.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.