{"id":"CVE-2026-69142","published":"2026-11-05T19:17:25.660","lastModified":"2026-11-05T19:17:25.793","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf","tags":[]}],"exploitRefs":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-pjc8-2w2x-xcgf","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated SQL injection flaw exists in SuiteCRM's jjwg_Maps map marker endpoint due to insufficient validation of the distance parameter, allowing attackers to manipulate SQL queries and access or modify sensitive database content.","exploitability":"Exploitation requires valid authentication but no elevated privileges, and the vulnerability is straightforward to exploit given public proof-of-concept references.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the CRM system and its underlying data, including customer records and internal operations.","remediation":"Upgrade to SuiteCRM version 7.15.2 or 8.10.2, where the issue is fixed by implementing strict numeric validation and parameterization of the distance parameter.","detection":"Look for SQL syntax errors or unexpected patterns in application logs related to the map_markers endpoint, especially when non-numeric values are passed in the distance field; also monitor for unusual database query durations or resource spikes on the application server.","tags":["sql-injection","web-app","crm","authenticated","open-source"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:55:11.499Z"}}