{"id":"CVE-2026-100365","published":"2026-11-05T19:16:59.133","lastModified":"2026-11-05T19:16:59.627","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89","CWE-943"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-6c7r-7g6m-29f9","tags":[]}],"exploitRefs":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-6c7r-7g6m-29f9","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection flaw in SuiteCRM's AOR report generation allows authenticated users to inject arbitrary SQL into ORDER BY clauses by manipulating stored field labels, enabling data exfiltration and denial of service via expensive queries.","exploitability":"Exploitation requires valid authentication and AOR Reports access; no user interaction or special conditions are needed beyond that.","blast_radius":"An attacker could extract sensitive database contents—including password hashes and arbitrary table data—and sustain resource exhaustion by submitting expensive ORDER BY expressions.","remediation":"Upgrade to SuiteCRM 7.15.2 or 8.10.2, where the issue is fixed; until then, restrict AOR Reports access to trusted users only and validate/sanitize field labels against an allowlist before use in ORDER BY clauses.","detection":"Look for unusually long or complex ORDER BY clauses in AOR report SQL logs, especially those containing concatenated field labels or non-standard expressions; also monitor for repeated high-latency report generation requests from the same authenticated user.","tags":["sql-injection","data-exfiltration","dos","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:54:34.870Z"}}