CVE-2019-25664
Last modified
CVE-2019-25664 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Salesagility | Suitecrm | <= 7.10.7 |
References
- https://suitecrm.com/Product
- https://www.exploit-db.com/exploits/46311Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameterThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-25664?
How severe is CVE-2019-25664?
How do I fix CVE-2019-25664?
Are you affected by CVE-2019-25664?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST