PT-2025-45525 · Suitecrm · Suitecrm

Published 2025-09-04 · Updated 2025-12-17 · CVE-2025-64492

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.0.0 through 8.9.0

Description SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A time-based blind SQL Injection flaw exists in versions 8.9.0 and below. This issue allows an authenticated attacker to potentially extract sensitive information from the database by observing response times. An attacker could enumerate database, table, and column names, extract data, or escalate privileges. SQL injection occurs when an attacker can manipulate a database query through crafted input, potentially leading to unauthorized access or data leakage. Over 1000 instances of SuiteCRM were identified in the Russian internet space.

Recommendations Update SuiteCRM to version 8.9.1.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-10914

CVE-2025-64492

GHSA-54M4-4P54-J8HP

Affected Products

Suitecrm

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64492.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-54m4-4p54-j8hp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64492 · Security Note
• https://bdu.fstec.ru/vul/2025-10914 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64492 · Vendor Advisory
• https://github.com/SuiteCRM/SuiteCRM-Core · Note
• https://twitter.com/cracbot/status/1988924854968717339 · Twitter Post
• https://t.me/CVEtracker/36836 · Telegram Post
• https://t.me/netlas/506 · Telegram Post
• https://t.me/pentestingnews/70774 · Telegram Post
• https://twitter.com/zoomeye_team/status/1988211093500817669 · Twitter Post
• https://twitter.com/CveTodo/status/1986984077501636965 · Twitter Post
• https://t.me/cveNotify/142189 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1988146719461138868 · Twitter Post
• https://twitter.com/CveFindCom/status/1986987132074729535 · Twitter Post