{"id":"CVE-2026-97377","published":"2026-11-05T19:17:29.280","lastModified":"2026-11-05T21:18:54.887","description":"SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-2hv5-wj8h-mv8m","tags":[]}],"exploitRefs":[{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2","tags":[]},{"url":"https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-2hv5-wj8h-mv8m","tags":[]}],"hasPoc":true,"ai":{"summary":"A blind SQL injection flaw exists in SuiteCRM's legacy SOAP portal method 'portal_get_entry_list' due to unsanitized user-controlled 'where' and 'order_by' parameters being directly used in SQL queries, allowing a low-privileged attacker to extract sensitive data and manipulate query behavior.","exploitability":"Exploitation requires valid low-privileged portal API credentials but is otherwise straightforward due to lack of input sanitization.","blast_radius":"Successful exploitation could lead to full database compromise including customer data, internal notes, and CRM metadata, enabling data exfiltration, account manipulation, or service disruption via resource exhaustion.","remediation":"Upgrade to SuiteCRM version 7.15.2 or 8.10.2, where the vulnerability is patched.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","blind-sqli","crm","soap-api","low-privilege"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:55:29.406Z"}}