SuiteCRM Authenticated Database Leak Vulnerability

A vulnerability allowing authenticated users to access arbitrary database fields has been identified in SuiteCRM versions through 7.12.7. This issue arises from improper handling of user permissions, enabling unauthorized data access.

Impact

Exploitation of this vulnerability leads to unauthorized access to sensitive database information, which could include user data or application configurations.

Reproduction

To reproduce this vulnerability, log into SuiteCRM as an authenticated user. Once logged in, navigate to the 'Home' module and use the 'Advanced Search' feature to search for a specific employee. After initiating the search, the vulnerability can be exploited by accessing the 'Employees' module and retrieving the 'whoami' command output, which confirms successful exploitation.

Remediation

Users are advised to upgrade to SuiteCRM version 7.12.8 or later, where this vulnerability has been addressed.