PT-2024-33683 · Suitecrm · Suitecrm

Dzentota · Published 2024-11-05 · Updated 2026-03-19 · CVE-2024-49774

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1

Description: The issue arises from the way SuiteCRM checks PHP scripts against a blacklist of functions and methods to prevent the installation of malicious MLPs. However, this check can be bypassed using certain syntax constructions. SuiteCRM uses the token get all function to parse PHP scripts and checks the resulting Abstract Syntax Tree (AST) against blacklists, but it does not account for all possible scenarios.

Recommendations: For versions prior to 7.14.6, upgrade to version 7.14.6 or later. For versions prior to 8.7.1, upgrade to version 8.7.1 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-SUITECRM-2024-49774

CVE-2024-49774

GHSA-9V56-VHP4-X227

Affected Products

Suitecrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49774.json · Exploit
• https://osv.dev/vulnerability/BIT-suitecrm-2024-49774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49774 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49774 · Vendor Advisory
• https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9v56-vhp4-x227 · Note
• https://t.me/cvenotify/101595 · Telegram Post
• https://twitter.com/CveFindCom/status/2034777718470922331 · Twitter Post
• https://twitter.com/CVEnew/status/1853870976129171489 · Twitter Post
• https://t.me/cvedetector/9946 · Telegram Post