CVE-2026-100365 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM, a widely deployed open-source Customer Relationship Management platform, contains a critical SQL injection vulnerability within its Advanced Reports module prior to version 7.15.2 for the legacy branch and 8.10.2 for the modern branch. The flaw resides in the report generation logic where user-supplied input is directly concatenated into an ORDER BY clause without proper sanitization or allowlisting mechanisms. Specifically, when a user with access to AOR Reports initiates a report query, the application takes field labels stored in the database and incorporates them directly into the SQL statement's sorting parameters. This architectural oversight allows authenticated attackers who possess at least basic reporting permissions to inject arbitrary SQL commands by manipulating these field label values or session states that influence the query construction process.
The technical nature of this vulnerability is classified as a blind time-based SQL injection, which falls under CWE-89 Improper Neutralization of Special Elements used in an SQL Command according to common weakness enumeration standards. Because the injected payload affects the ORDER BY clause rather than standard data retrieval fields like SELECT or WHERE, traditional error-based extraction methods are often ineffective. Instead, attackers must rely on time-delay techniques to exfiltrate data. By crafting specific payloads that trigger conditional database delays based on boolean outcomes of subqueries, an attacker can systematically extract sensitive information bit by bit. This technique is consistent with ATT&CK tactic T1078 Valid Accounts and the exploitation phase involving SQL injection for data extraction.
The operational impact of this vulnerability is severe due to its potential for full database compromise despite requiring authentication. An authenticated user can leverage this flaw to perform time-based extraction of password hashes, effectively bypassing application-level security controls to gain access to administrative accounts or other privileged users within the system. Furthermore, the attacker can extract arbitrary table data from the underlying MySQL or PostgreSQL database, potentially exposing customer personal information, financial records, and proprietary business intelligence stored in the CRM. Beyond data theft, the vulnerability allows for denial of service conditions by holding expensive database connections open through complex, resource-intensive expressions that degrade server performance and availability for legitimate users.
Mitigation strategies require immediate action to patch the affected software versions. Organizations running SuiteCRM must upgrade to version 7.15.2 or later if using the legacy branch, or version 8.10.2 or later if utilizing the modern architecture. These releases include fixes that implement proper allowlisting and input validation for field labels used in sorting operations, ensuring that only predefined, safe column names are accepted by the database engine. In environments where immediate patching is not feasible due to operational constraints, administrators should restrict access to the AOR Reports module to trusted users with minimal necessary privileges. Additionally, deploying a Web Application Firewall can provide a layer of defense by detecting and blocking SQL injection patterns in HTTP requests targeting report generation endpoints, although this serves only as a compensating control rather than a complete solution.