CVE-2024-49773 MEDIUM

CVE-2024-49773: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

Vendor Salesagility

Product SuiteCRM

Weakness CWE-89 · SQLi

Published November 5, 2024

Last update November 5, 2024

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export` entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

November 5, 2024 CVE published

November 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-49773 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2024-49773

CWE CWE-89

CVSS 5.3 / MEDIUM

Affected versions

Vendor Salesagility

Product SuiteCRM

Affected < 7.14.6

Vendor Salesagility

Product SuiteCRM

Affected >= 8.0.0, < 8.7.1

CVE-2024-49773: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

01Description

02Disclosure timeline

03References

04Related CVE