CVE-2026-100359 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely adopted open-source Customer Relationship Management platform designed for enterprise environments, facilitating the management of customer interactions, sales pipelines, and project workflows. Within this ecosystem, the Project Template module provides functionality to manage task dependencies and scheduling through specific API endpoints. A critical security flaw was identified in versions prior to 7.15.2 and 8.10.2 within the action_get_end_date function associated with these templates. This vulnerability stems from a fundamental failure in input validation and query construction practices, specifically involving how user-supplied data is handled during database operations.
The technical root cause of this vulnerability lies in the direct interpolation of authenticated caller-controlled parameters into SQL queries without adequate sanitization or parameterization. Specifically, the action_get_end_date function accepts POST requests containing task_id and lag parameters derived from project template configurations. Instead of using prepared statements with bound variables to separate code from data, the application concatenates these inputs directly into the SQL string executed against the backend database. This architectural oversight allows an attacker who has valid authentication credentials for any user account within the SuiteCRM instance to inject arbitrary SQL commands. The vulnerability is classified as a blind SQL injection because the application does not return direct error messages or query results in the HTTP response, requiring attackers to infer data extraction through time-based or boolean-based techniques rather than immediate feedback.
The operational impact of this flaw is severe due to its potential for unauthorized data exfiltration and system compromise. Because SuiteCRM typically stores sensitive enterprise information including customer personal identifiable information, internal communications, financial records, and potentially hashed credentials for other systems, the ability to read arbitrary database contents poses a significant risk to organizational confidentiality and integrity. An authenticated attacker can leverage this blind SQL injection to enumerate database schema details, extract specific rows from tables containing proprietary business data, or even escalate privileges if certain database configurations allow for command execution via functions like xp_cmdshell in Microsoft SQL Server environments. The requirement for authentication limits the attack surface compared to unauthenticated vulnerabilities but still represents a serious threat as many organizations may have compromised user accounts through phishing or credential stuffing attacks that could then be leveraged against this specific endpoint.
This vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The lack of parameterized queries violates secure coding standards such as those outlined by the OWASP Top Ten under injection flaws and fails to adhere to principles found in CERT Secure Coding Standards for database interaction. From a tactical perspective, this exploitation technique corresponds to ATT&CK techniques related to Data from Information Repositories and potentially Taint Analysis if used to map out internal network structures via side-channel timing attacks. The blind nature of the injection means that while detection might be more difficult than with error-based injections, it remains highly effective for systematic data extraction over time.
Mitigation strategies must prioritize immediate patching as well as broader defensive coding practices. Organizations running SuiteCRM versions prior to 7.15.2 and 8.10.2 should upgrade to the latest patched releases where this interpolation issue has been resolved through proper parameterization of SQL queries. In addition to applying vendor patches, security teams should implement Web Application Firewalls configured with rulesets capable of detecting anomalous SQL patterns in POST parameters, although such controls are secondary to fixing the root cause. Developers must enforce strict input validation and utilize ORM frameworks or prepared statements exclusively for all database interactions to prevent similar injection vulnerabilities across other modules. Regular code audits focusing on data flow from user inputs to database queries can further reduce the risk of recurrence by ensuring that no unsanitized variables reach execution contexts within the application logic.