CVE-2026-69142 in SuiteCRM
Summary
by MITRE • 11/05/2026
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
SuiteCRM serves as a widely deployed open-source Customer Relationship Management platform designed to help organizations manage customer interactions, sales pipelines, and marketing campaigns. Within this ecosystem, the jjwg_Maps module provides geospatial functionality, allowing users to visualize data points on interactive maps. A critical security flaw was identified in the map marker endpoint prior to versions 7.15.2 and 8.10.2, specifically within the logic handling the distance parameter during the execution of the map_markers action. This vulnerability stems from a failure to implement strict input validation or use prepared statements when processing user-supplied data that influences database queries.
The technical root cause of this issue is an SQL injection flaw resulting from improper sanitization of the authenticated caller's distance value. Although authentication is required to access this endpoint, which limits the attack surface compared to unauthenticated vulnerabilities, it does not mitigate the risk for legitimate users whose credentials may be compromised or who are malicious insiders. The application directly concatenates or interpolates the user-provided distance parameter into an SQL query without ensuring that the input consists solely of numeric values or by using parameterized queries with type casting. This lack of strict numeric validation allows an attacker to inject arbitrary SQL code, effectively bypassing intended logic constraints and manipulating the database engine's execution path.
The operational impact of this vulnerability is significant for organizations relying on SuiteCRM for sensitive business operations. An authenticated attacker can exploit this flaw to extract confidential data stored in the underlying database, including customer personal information, sales records, and internal communications. Beyond data exfiltration, the attacker can modify query results, potentially altering displayed map markers or corrupting associated metadata. Furthermore, complex injected queries can be used to consume excessive server resources through time-based attacks or large result set retrievals, leading to denial of service conditions that degrade application performance for all users.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. From a tactical perspective, this exploitation technique corresponds to the ATT&CK framework techniques related to Database Credential Harvesting and Data from Information Repositories, specifically involving direct database access via application-layer vulnerabilities. The reliance on authentication highlights that even internal-facing or user-specific endpoints require rigorous input validation to prevent privilege escalation through data manipulation rather than just unauthorized access.
To mitigate this risk, organizations must upgrade SuiteCRM to version 7.15.2 or later for the legacy branch and version 8.10.2 or later for the modern branch, where these inputs are properly validated and parameterized. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include implementing a Web Application Firewall with rules specifically targeting SQL injection patterns in map-related endpoints. Additionally, enforcing strict input validation at the application layer by ensuring that distance parameters accept only integer values can provide an additional defense-in-depth layer. Regular security audits and code reviews focusing on database interaction points are recommended to prevent similar vulnerabilities from being introduced during future development cycles.