SuiteCRM Time-Based Blind SQL Injection Vulnerability

A time-based blind SQL injection vulnerability has been identified in SuiteCRM versions through 8.9.0. This vulnerability allows authenticated attackers to infer data from the database by measuring response times, potentially leading to the extraction of sensitive information. Attackers could enumerate database, table, and column names, extract sensitive data such as user credentials and personal information, or escalate privileges in some database configurations.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to enumerate database, table, and column names, extract sensitive data from the database, such as hashed passwords and personal information, and in some cases, escalate privileges or achieve remote code execution.

Remediation

Users can upgrade to SuiteCRM version 8.9.1 to address this vulnerability.