Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SuiteCRM | SuiteCRM-Core | >= 8.6.0, < 8.9.1 | — |
Advisories 1
- WID-SEC-2025-2517 SuiteCRM: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Nov 9, 2025