CVE-2026-61653 · Package
NO FIX YET · SEE WHAT TO DO
SuiteCRM's Campaigns ROI popup puts a request parameter into a SQL query without proper escaping, so a crafted input can slip a quote through. An authenticated user with Campaigns access can run time-based blind SQL injection to read arbitrary database tables.
first public Jul 31, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any SuiteCRM installation earlier than 7.15.2 or 8.10.2 is exposed, and the attacker needs a login with access to the Campaigns module. Teams that run SuiteCRM themselves should patch; hosted SaaS users depend on the vendor.
Not affected if managed-hosting, no-campaigns-access, patched-version
Who cares crm, php, self-hosted, suitecrm
modules/Campaigns/PopupCampaignRoi.php in the installation and confirm whether it is present on the server7.15.28.10.2SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.