{"id":"CVE-2026-61648","kind":"vulnerability","aliases":["CVE-2026-61648"],"related":[],"title":"SuiteCRM: Multi report condition lets low-privileged users run SQL injection","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"A user-controllable Multi report condition in SuiteCRM's AOR Reports concatenates input into a SQL WHERE clause, and an XSS-prefixed input defeats the quote encoding. A low-privileged user with AOR Reports access can read arbitrary database tables through time-based or UNION-based SQL injection and can exhaust database connections with delay expressions.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","self-hosted","suitecrm"],"not_affected_if":["aor-reports-disabled","managed-hosting-patched"],"how_to_check":"- Check the installed SuiteCRM version and compare it with the fixed versions below.\n- Confirm whether the AOR Reports module is enabled and which users hold access to it.","fix":"- SuiteCRM 7.x: upgrade to `7.15.2`\n- SuiteCRM 8.x: upgrade to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:42:52+00:00","updated_at":"2026-11-05T19:42:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T19:42:52Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: upgrade to `7.15.2`\n- SuiteCRM 8.x: upgrade to `8.10.2`","reach":"network","title":"SuiteCRM: Multi report condition lets low-privileged users run SQL injection","impact":"high","summary":"A user-controllable Multi report condition in SuiteCRM's AOR Reports concatenates input into a SQL WHERE clause, and an XSS-prefixed input defeats the quote encoding. A low-privileged user with AOR Reports access can read arbitrary database tables through time-based or UNION-based SQL injection and can exhaust database connections with delay expressions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","mysql"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reads arbitrary database tables and exhausts connections","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version and compare it with the fixed versions below.\n- Confirm whether the AOR Reports module is enabled and which users hold access to it.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting-patched","aor-reports-disabled"],"who_is_affected":"Teams running self-hosted SuiteCRM with the AOR Reports module in use, where users have report access. Instances on versions other than the 7.x and 8.x lines listed in the fixed versions are the ones to examine. Managed hosting providers should confirm whether they have applied the update.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4442,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61648':15A,18A '7.15.2':104C,198C '8.10.2':106C,200C 'access':63B,169C 'allow':153C 'although':128C 'antixss':143C 'aor':36B,61B,167C 'applic':101C 'arbitrari':66B,172C 'backup':152C 'base':72B,76B,177C,181C 'claus':44B,127C 'concaten':38B,120C 'condit':4A,32B,113C 'connect':83B,188C 'consum':186C 'control':29B,110C 'crm':99C 'custom':96C 'cve':13A,16A 'databas':67B,82B,160C,187C 'defeat':51B 'delay':85B,190C 'encod':54B,133C,151C 'enterpris':94C 'enterprise-readi':93C 'entiti':132C 'entity-encod':131C 'exhaust':81B 'express':86B,191C 'fix':195C 'host':24B 'inject':12A,78B,183C 'input':39B,50B,136C 'instead':148C 'issu':193C 'let':5A 'liter':155C 'low':7A,57B,163C 'low-privileg':6A,56B,162C 'make':142C 'manag':98C 'multi':2A,30B,111C 'mysql':19B 'normal':130C 'open':91C 'open-sourc':90C 'packag':20B 'paramet':115C 'pass':114C 'payload':141C 'php':21B 'prefix':49B,137C 'prior':102C 'privileg':8A,58B,164C 'process':146C 'quot':53B,134C,156C 'reach':158C 'read':65B,171C 'readi':95C 'relationship':97C 'report':3A,31B,37B,62B,112C,168C 'result':122C 'run':10A 'securexss':129C 'select':144C 'self':23B 'self-host':22B 'softwar':100C 'sourc':92C 'sql':11A,42B,77B,125C,182C 'string':147C 'suitecrm':1A,25B,34B,87C 'tabl':68B,173C 'time':71B,176C 'time-bas':70B,175C 'unencodemultienum':118C 'union':75B,180C 'union-bas':74B,179C 'user':9A,28B,59B,109C,165C 'user-control':27B,108C 'valu':116C 'version':197C 'xss':48B,140C 'xss-prefix':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted SuiteCRM with the AOR Reports module in use, where users have report access. Instances on versions other than the 7.x and 8.x lines listed in the fixed versions are the ones to examine. Managed hosting providers should confirm whether they have applied the update.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","mysql","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:13:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61648","severity":null,"published_at":"2026-11-05T19:17:22+00:00","modified_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79233,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pqq6-v2mj-hrm2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:13:34+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}