{"id":"CVE-2026-69142","kind":"vulnerability","aliases":["CVE-2026-69142"],"related":[],"title":"SuiteCRM: map marker distance parameter enables SQL injection by logged-in users","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.","summary":"SuiteCRM's map marker endpoint in the jjwg_Maps module passes the distance value into a SQL query without strict numeric validation. An authenticated user can change the query to read database contents, alter results, and consume server resources.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","sql","suitecrm"],"not_affected_if":["managed-hosting","maps-module-disabled","patched-version"],"how_to_check":"- Check the SuiteCRM version in the installation (for example, the version shown in the admin area or `config.php`).\n- Confirm whether the Maps module (jjwg_Maps) is enabled.","fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","status":"open","published_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","triaged_at":"2026-11-05T19:42:34+00:00","updated_at":"2026-11-05T19:42:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T19:42:34Z","model":"claude-haiku-5-5","output":{"fix":"- SuiteCRM 7.x: move to `7.15.2`\n- SuiteCRM 8.x: move to `8.10.2`","reach":"internet","title":"SuiteCRM: map marker distance parameter enables SQL injection by logged-in users","impact":"high","summary":"SuiteCRM's map marker endpoint in the jjwg_Maps module passes the distance value into a SQL query without strict numeric validation. An authenticated user can change the query to read database contents, alter results, and consume server resources.","audience":"businesses","category":"package","nicknames":[],"who_cares":["suitecrm","self-hosted","php","sql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"database contents readable and query results altered by any logged-in user","analyst_note":"Confirm whether the Maps module is enabled by default and whether the vendor advisory and release notes name this CVE with the same fixed versions; the linked patch pages were not read.","how_to_check":"- Check the SuiteCRM version in the installation (for example, the version shown in the admin area or `config.php`).\n- Confirm whether the Maps module (jjwg_Maps) is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","maps-module-disabled","patched-version"],"who_is_affected":"SuiteCRM installations older than 7.15.2 or 8.10.2 that have the Maps module in use are exposed. The attacker must hold a valid user account on the CRM, so instances with self-registration or many shared logins carry more risk. Hosted SaaS instances are handled by the vendor, so a team using a managed service should confirm the patch level with the provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4356,"output_tokens":623,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-69142':16A,19A '7.15.2':83C,133C '8.10.2':85C,135C 'action':103C 'alter':60B,114C 'applic':80C 'attack':112C 'authent':50B,94C,111C 'caller':95C 'chang':53B 'consum':63B,125C 'content':59B 'crm':78C 'custom':75C 'cve':14A,17A 'data':120C 'databas':58B,119C 'distanc':4A,39B,97C 'enabl':6A 'endpoint':31B,91C 'enterpris':73C 'enterprise-readi':72C 'extract':118C 'fix':130C 'host':24B 'inject':8A 'issu':128C 'jjwg':34B,87C 'log':11A 'logged-in':10A 'manag':77C 'map':2A,29B,35B,88C,89C,101C 'marker':3A,30B,90C,102C 'modifi':121C 'modul':36B 'numer':47B,106C 'open':70C 'open-sourc':69C 'packag':20B 'paramet':5A 'parameter':109C 'pass':37B 'php':21B 'prior':81C 'queri':44B,55B,117C,122C 'read':57B 'readi':74C 'relationship':76C 'resourc':65B,126C 'result':61B,123C 'self':23B 'self-host':22B 'server':64B 'softwar':79C 'sourc':71C 'sql':7A,25B,43B,116C 'strict':46B,105C 'suitecrm':1A,26B,27B,66C 'use':92C 'user':13A,51B 'valid':48B,107C 'valu':40B,98C 'version':132C 'without':45B,104C","nicknames":[],"mitigations":[],"who_affected":"SuiteCRM installations older than 7.15.2 or 8.10.2 that have the Maps module in use are exposed. The attacker must hold a valid user account on the CRM, so instances with self-registration or many shared logins carry more risk. Hosted SaaS instances are handled by the vendor, so a team using a managed service should confirm the patch level with the provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","selfhosted","sql","suitecrm"],"campaign_type":null,"first_public_at":"2026-08-05T11:41:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-69142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69142","severity":null,"published_at":"2026-11-05T19:17:25+00:00","modified_at":"2026-11-05T19:17:25+00:00","first_seen_at":"2026-11-05T19:40:38+00:00","fetched_at":"2026-11-05T19:40:38+00:00","note":null}],"documents":[{"id":79135,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79136,"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79137,"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79138,"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79318,"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-08-05T11:41:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}