SuiteCRM Type Confusion Vulnerability in 'deleteAttachment' Functionality Allowing Database Manipulation

A type confusion vulnerability has been identified in SuiteCRM versions prior to 7.12.6. The issue arises in the 'deleteAttachment' feature, specifically within the 'module' parameter processing. Exploitation of this vulnerability enables remote, unauthenticated attackers to modify database objects, including changing the administrator's email address.

Impact

Exploitation of this vulnerability allows for unauthorized modification of database objects, with the potential to change critical information such as the administrator's email address.

Remediation

Users are advised to upgrade to SuiteCRM version 7.12.6 or later, where this vulnerability has been addressed.