CVE-2026-61648 · Package
NO FIX YET · SEE WHAT TO DO
A user-controllable Multi report condition in SuiteCRM's AOR Reports concatenates input into a SQL WHERE clause, and an XSS-prefixed input defeats the quote encoding. A low-privileged user with AOR Reports access can read arbitrary database tables through time-based or UNION-based SQL injection and can exhaust database connections with delay expressions.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running self-hosted SuiteCRM with the AOR Reports module in use, where users have report access. Instances on versions other than the 7.x and 8.x lines listed in the fixed versions are the ones to examine. Managed hosting providers should confirm whether they have applied the update.
Not affected if aor-reports-disabled, managed-hosting-patched
Who cares mysql, php, self-hosted, suitecrm
7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.