PT-2025-45523 · Suitecrm · Suitecrm

Published 2025-11-04 · Updated 2025-11-08 · CVE-2025-64488

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 7.14.7 and below SuiteCRM versions 8.0.0-beta.1 through 8.9.0

Description SuiteCRM is a Customer Relationship Management (CRM) software application. An attacker can manipulate the call id to modify SQL query logic or inject arbitrary SQL code. This could result in unauthorized data access, data exfiltration, and potential complete database compromise.

Recommendations Update to SuiteCRM version 7.14.8 or later. Update to SuiteCRM version 8.9.1 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-13976

CVE-2025-64488

GHSA-5V53-V44Q-WW2C

Affected Products

Suitecrm

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64488.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM/commit/40da2845a170832a4e9e9fa0ebe731f8c34de42d · Patch
• https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5v53-v44q-ww2c · Vendor Advisory
• https://github.com/SuiteCRM/SuiteCRM-Core/commit/30277cfe69755f7360a23d4805e06a5c38f14131 · Patch
• https://bdu.fstec.ru/vul/2025-13976 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64488 · Security Note
• https://t.me/CVEtracker/36832 · Telegram Post
• https://twitter.com/CVEnew/status/1986963140601421973 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1987020688356413628 · Twitter Post