CVE-2026-29096— SuiteCRM SQL注入漏洞

SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or editing a report (AOR_Reports module), the `field_function` parameter from POST data is saved directly into the `aor_fields` table without any validation. Later, when the report is executed/viewed, this value is concatenated directly into a SQL SELECT query without sanitization, enabling second-order SQL injection. Any authenticated user with Reports access can extract arbitrary database contents (password hashes, API tokens, config values). On MySQL with FILE privilege, this could lead to RCE via SELECT INTO OUTFILE. Versions 7.15.1 and 8.9.3 patch the issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

SuiteCRM SQL注入漏洞

SuiteCRM是SuiteCRM团队的一个客户关系管理系统。 SuiteCRM 7.15.1之前版本和8.9.3之前版本存在SQL注入漏洞，该漏洞源于创建或编辑报告时，POST数据中的field_function参数未经任何验证即被直接保存到aor_fields表中，随后在执行或查看报告时，该值未经清理直接拼接到SQL SELECT查询中，可能导致二阶SQL注入，从而允许经过身份验证的用户提取任意数据库内容。

N/A

N/A