{"id":"CVE-2026-69141","kind":"vulnerability","aliases":["CVE-2026-69141"],"related":[],"title":"SuiteCRM: crafted search input lets low-privileged users run blind SQL injection","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's Cases knowledge-base search passes the POST search parameter into a SQL query without proper escaping, because an XSS-style prefix makes the sanitizer return an unencoded string. A low-privileged user with Cases module access can extract sensitive database contents through blind SQL injection.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","suitecrm"],"not_affected_if":["fixed-version","no-cases-access"],"how_to_check":"- Find the SuiteCRM version in use and compare it to the fixed versions listed below.\n- Check whether users with only Cases module access can reach the knowledge-base article search on Cases.","fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","status":"open","published_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:42:43+00:00","updated_at":"2026-11-05T19:42:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: `7.15.2`\n- SuiteCRM 8.x: `8.10.2`","reach":"network","title":"SuiteCRM: crafted search input lets low-privileged users run blind SQL injection","impact":"high","summary":"SuiteCRM's Cases knowledge-base search passes the POST search parameter into a SQL query without proper escaping, because an XSS-style prefix makes the sanitizer return an unencoded string. A low-privileged user with Cases module access can extract sensitive database contents through blind SQL injection.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"database contents extracted by a low-privileged logged-in user","analyst_note":"","how_to_check":"- Find the SuiteCRM version in use and compare it to the fixed versions listed below.\n- Check whether users with only Cases module access can reach the knowledge-base article search on Cases.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-cases-access"],"who_is_affected":"SuiteCRM installations before 7.15.2 and before 8.10.2 are exposed, through the Cases module's knowledge-base article search. The attacker needs a low-privileged account with access to the Cases module. Installations already on the fixed versions are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000713,"input_tokens":4430,"output_tokens":539,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-69141':16A,19A '7.15.2':93C,175C '8.10.2':95C,177C 'access':66B,158C 'action':98C,102C 'allow':142C 'although':117C 'antixss':132C 'applic':90C 'articl':101C 'backup':141C 'base':31B 'blind':11A,73B,161C 'case':28B,64B,108C,156C 'casescontrol':97C 'claus':116C 'content':71B 'craft':2A 'crm':88C 'custom':85C 'cve':14A,17A 'databas':70B,167C 'encod':122C,140C 'enterpris':83C 'enterprise-readi':82C 'entiti':121C 'entity-encod':120C 'escap':44B 'express':111C 'extract':68B,165C 'fix':172C 'get':99C 'host':24B 'inform':168C 'inject':13A,75B,163C 'input':4A,125C 'instead':137C 'interpol':103C 'issu':170C 'kb':100C 'knowledg':30B 'knowledge-bas':29B 'let':5A 'like':110C 'liter':144C 'low':7A,60B,152C 'low-privileg':6A,59B,151C 'make':51B,131C 'manag':87C 'modul':65B,157C 'normal':119C 'open':80C 'open-sourc':79C 'packag':20B 'paramet':37B 'pass':33B 'payload':130C 'perform':160C 'php':21B 'post':35B,104C 'prefix':50B,126C 'prior':91C 'privileg':8A,61B,153C 'process':135C 'proper':43B 'queri':41B,149C 'quot':123C,145C 'reach':147C 'readi':84C 'relationship':86C 'return':54B 'run':10A 'sanit':53B 'search':3A,32B,36B,105C 'securexss':118C 'select':133C 'self':23B 'self-host':22B 'sensit':69B,166C 'softwar':89C 'sourc':81C 'sql':12A,40B,74B,114C,162C 'string':57B,136C 'style':49B 'suitecrm':1A,25B,26B,76C 'unencod':56B 'user':9A,62B,154C 'version':174C 'without':42B 'xss':48B,129C 'xss-style':47B","nicknames":[],"mitigations":[],"who_affected":"SuiteCRM installations before 7.15.2 and before 8.10.2 are exposed, through the Cases module's knowledge-base article search. The attacker needs a low-privileged account with access to the Cases module. Installations already on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","selfhosted","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:40:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69141","severity":null,"published_at":"2026-11-05T19:17:25+00:00","modified_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79313,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-wphj-qjgj-4j23","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:40:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}