PT-2025-45526 · Suitecrm · Suitecrm

Published 2025-11-06 · Updated 2025-12-17 · CVE-2025-64493

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM versions 8.6.0 through 8.9.0

Description SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.6.0 through 8.9.0 are susceptible to an authenticated, blind (time-based) SQL-injection within the appMetadata operation of the GraphQL API. This allows for the extraction of arbitrary data from the database without requiring administrative access. The GraphQL API endpoint is '/graphql'. The vulnerable operation is appMetadata.

Recommendations Versions prior to 8.9.1 are affected. Update to version 8.9.1 or later to resolve this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-13970

CVE-2025-64493

GHSA-5GCJ-MFQQ-V8F7

Affected Products

Suitecrm

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64493.json · Exploit
• https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories/GHSA-5gcj-mfqq-v8f7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-13970 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64493 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64493 · Security Note
• https://twitter.com/fridaysecurity/status/1988044977897648418 · Twitter Post
• https://docs.suitecrm.com/community/security-policy · Note
• https://twitter.com/Komodosec/status/2001368193886228616 · Twitter Post
• https://t.me/CVEtracker/36837 · Telegram Post
• https://t.me/pentestingnews/70774 · Telegram Post
• https://twitter.com/zoomeye_team/status/1988211093500817669 · Twitter Post
• https://twitter.com/CriminalIP_US/status/1988879515632967754 · Twitter Post
• https://t.me/cveNotify/142190 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/1988146719461138868 · Twitter Post
• https://twitter.com/CVEnew/status/1986999093160521880 · Twitter Post