PT-2025-32235 · Suitecrm · Suitecrm

Parnuski · Published 2025-08-06 · Updated 2025-08-14 · CVE-2025-54788

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SuiteCRM versions prior to 7.14.7

Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely.

Recommendations Update SuiteCRM to version 7.14.7.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-09474

CVE-2025-54788

GHSA-V3M9-8WG7-C72X

Affected Products

Suitecrm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54788.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54788 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54788 · Security Note
• https://bdu.fstec.ru/vul/2025-09474 · Security Note
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x · Note
• https://twitter.com/CVEnew/status/1953264176974921969 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1953334472952197155 · Twitter Post
• https://t.me/cveNotify/132348 · Telegram Post
• https://t.me/CVEtracker/29406 · Telegram Post
• https://t.me/purp_sec/1021 · Telegram Post
• https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7 · Note
• https://twitter.com/cracbot/status/1955222775376785450 · Twitter Post
• https://twitter.com/CveFindCom/status/1953247403726754026 · Twitter Post