CVE-2026-61651 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's Projects controller concatenates a task_id value into a SQL query in the get_end_date action without parameterization. An authenticated low-privileged user can use blind SQL injection to enumerate the schema and extract credentials and customer records.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM instance before 7.15.2 or 8.10.2 where a logged-in user, including a low-privileged one, can reach the Projects get_end_date action. Exposure depends on user accounts that can authenticate to the application; instances with no untrusted user accounts carry less risk but should still be patched.
Not affected if managed-hosting, patched-version
Who cares crm, php, self-hosted, suitecrm
7.15.2 on the 7.x line or below 8.10.2 on the 8.x line are affected.7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.