CVE-2019-25664

Name of the Vulnerable Software and Affected Versions SuiteCRM version 7.10.7

Description Authenticated attackers can manipulate database queries via a time-based blind SQL injection. This occurs when SQL code is appended to the record parameter in GET requests sent to the 'index.php' endpoint within the Users module DetailView action. This technique allows for the extraction of sensitive information from the database by analyzing the time the server takes to respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the record parameter in the 'index.php' endpoint of the Users module until the issue is resolved.