PT-2026-26441 · Suitecrm · Suitecrm
Dqh1
·
Publicado
2026-03-19
·
Atualizado
2026-05-13
·
CVE-2026-29103
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SuiteCRM versions 7.15.0 and 8.9.2
Description
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A critical Remote Code Execution (RCE) issue exists, allowing authenticated administrators to execute arbitrary system commands. The issue is a bypass of a previous patch attempt for CVE-2024-49774. The underlying flaw resides in the
ModuleScanner.php file, specifically in its PHP token parsing logic. The scanner incorrectly resets its internal state ($checkFunction flag) when encountering single-character tokens (such as =, ., or ;). This allows attackers to conceal dangerous function calls, like system() or exec(), using variable assignments or string concatenation, effectively bypassing the MLP security controls.Recommendations
Update to SuiteCRM version 7.15.1 or 8.9.3.
Exploit
Correção
RCE
Code Injection
Improperly Implemented Security Check for Standard
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suitecrm