{"id":"CVE-2026-61651","kind":"vulnerability","aliases":["CVE-2026-61651"],"related":[],"title":"SuiteCRM: blind SQL injection lets low-privileged users extract database contents","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's Projects controller concatenates a task_id value into a SQL query in the get_end_date action without parameterization. An authenticated low-privileged user can use blind SQL injection to enumerate the schema and extract credentials and customer records.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm","package","php","self-hosted","suitecrm"],"not_affected_if":["managed-hosting","patched-version"],"how_to_check":"- Check the installed SuiteCRM version in the application's admin or version file; versions below `7.15.2` on the 7.x line or below `8.10.2` on the 8.x line are affected.\n- Confirm whether the Projects module is in use.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","triaged_at":"2026-11-05T19:42:48+00:00","updated_at":"2026-11-05T19:42:48+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-05T19:42:48Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: blind SQL injection lets low-privileged users extract database contents","impact":"high","summary":"SuiteCRM's Projects controller concatenates a task_id value into a SQL query in the get_end_date action without parameterization. An authenticated low-privileged user can use blind SQL injection to enumerate the schema and extract credentials and customer records.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","crm"],"confidence":0.75,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads database credentials and customer records","analyst_note":"","how_to_check":"- Check the installed SuiteCRM version in the application's admin or version file; versions below `7.15.2` on the 7.x line or below `8.10.2` on the 8.x line are affected.\n- Confirm whether the Projects module is in use.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","patched-version"],"who_is_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 where a logged-in user, including a low-privileged one, can reach the Projects get_end_date action. Exposure depends on user accounts that can authenticate to the application; instances with no untrusted user accounts carry less risk but should still be patched.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4357,"output_tokens":562,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-61651':15A,18A '7.15.2':85C,140C '8.10.2':87C,142C 'action':44B,92C 'applic':82C 'authent':48B,98C 'blind':2A,55B,117C 'caller':99C 'concaten':30B,96C 'content':12A,133C 'control':29B,95C 'credenti':64B,127C 'crm':19B,80C 'custom':66B,77C,128C 'cve':13A,16A 'databas':11A,123C,132C 'date':43B,91C 'end':42B,90C 'enterpris':75C 'enterprise-readi':74C 'enumer':59B,121C 'extract':10A,63B,126C 'fix':137C 'get':41B,89C 'host':24B 'id':33B,102C 'inject':4A,57B,119C 'issu':135C 'let':5A 'low':7A,50B,112C 'low-privileg':6A,49B,111C 'manag':79C 'open':72C 'open-sourc':71C 'packag':20B 'parameter':46B,109C 'php':21B 'prior':83C 'privileg':8A,51B,113C 'project':28B,94C 'queri':38B,107C 'readi':76C 'record':67B,129C 'relationship':78C 'schema':61B,124C 'self':23B 'self-host':22B 'softwar':81C 'sourc':73C 'sql':3A,37B,56B,106C,118C 'suitecrm':1A,25B,26B,68C 'task':32B,101C 'use':54B,116C 'user':9A,52B,114C 'valu':34B,103C 'version':139C 'without':45B,108C","nicknames":[],"mitigations":[],"who_affected":"Any SuiteCRM instance before 7.15.2 or 8.10.2 where a logged-in user, including a low-privileged one, can reach the Projects get_end_date action. Exposure depends on user accounts that can authenticate to the application; instances with no untrusted user accounts carry less risk but should still be patched.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crm","high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-07-31T14:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61651","severity":null,"published_at":"2026-11-05T19:17:22+00:00","modified_at":"2026-11-05T19:17:22+00:00","first_seen_at":"2026-11-05T19:40:37+00:00","fetched_at":"2026-11-05T19:40:37+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79248,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-7cj5-pc2f-9xgv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T14:16:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}