CVE-2019-25664

SuiteCRM 7.10.7 SQL Injection via record Parameter

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

Affected

Suitecrm · SuiteCRM

CVSS v4.0 VULNCHECK

7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-04-05

Updated

2026-04-06

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/46311

Security advisories

• https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter
• https://suitecrm.com
• https://suitecrm.com/download

References

• CVE Record
• NVD entry