PT-2024-34145 · Suitecrm · Suitecrm

Amame04 · Published 2024-11-05 · Updated 2025-09-03 · CVE-2024-50332

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.14.6 SuiteCRM versions prior to 8.7.1

Description: The issue is caused by insufficient input value validation, leading to Blind SQL injection in the DeleteRelationShip function. This allows for potential exploitation. Users are advised to upgrade to address the issue.

Recommendations: For versions prior to 7.14.6, upgrade to version 7.14.6 or later. For versions prior to 8.7.1, upgrade to version 8.7.1 or later. As a temporary workaround, consider restricting access to the DeleteRelationShip function until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SUITECRM-2024-50332

CVE-2024-50332

GHSA-53XH-MJMQ-J35P

Affected Products

Suitecrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50332.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50332 · Security Note
• https://osv.dev/vulnerability/BIT-suitecrm-2024-50332 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50332 · Vendor Advisory
• https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-53xh-mjmq-j35p · Note
• https://twitter.com/CVEnew/status/1853870973583257721 · Twitter Post
• https://twitter.com/CveFindCom/status/1853875215828238817 · Twitter Post
• https://twitter.com/Cezar_H_Linux/status/1963307688273576381 · Twitter Post
• https://t.me/cvedetector/9943 · Telegram Post