PT-2026-30473 · Suitecrm+1 · Suitecrm

Mehmet Emiroglu · CVE-2019-25664 · Published 2026-04-05 · Updated 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions SuiteCRM version 7.10.7

Description Authenticated attackers can manipulate database queries via a time-based blind SQL injection. This occurs when SQL code is appended to the record parameter in GET requests sent to the 'index.php' endpoint within the Users module DetailView action. This technique allows for the extraction of sensitive information from the database by analyzing the time the server takes to respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the record parameter in the 'index.php' endpoint of the Users module until the issue is resolved.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25664

Affected Products

Suitecrm

References · 5

• 🔥 https://exploit-db.com/exploits/46311 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25664 · Security Note
• https://suitecrm.com · Note
• https://suitecrm.com/download · Note
• https://vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter · Note