SuiteCRM SQL Injection Vulnerability in Outbound Email Module

A SQL injection vulnerability has been identified in SuiteCRM versions 7.15.0 and prior, as well as 8.9.0 and prior. The issue arises in the 'retrieve()' function within 'include/OutboundEmail/OutboundEmail.php', where the user-controlled '$id' parameter is not properly sanitized. This vulnerability can be exploited by authenticated users through the 'EmailUIAjax' action in the 'Email()' module. The lack of restrictions on database table access allows attackers to retrieve arbitrary information, including user data and password hashes.

Impact

Exploitation of this vulnerability could lead to authenticated blind SQL injection, allowing attackers to manipulate database queries and potentially access sensitive information such as user details and password hashes.

Remediation

Users can upgrade to SuiteCRM version 7.15.1 or 8.9.3 to address this vulnerability.