SuiteCRM Remote Code Execution Vulnerability

A critical remote code execution vulnerability has been identified in SuiteCRM versions 7.15.0 and 8.9.2. This vulnerability allows authenticated administrators to execute arbitrary system commands. It arises from a patch bypass of a previous vulnerability (CVE-2024-49774), where the underlying issue in the PHP token parsing of the ModuleScanner.php file was not fully addressed. The scanner's incorrect handling of single-character tokens enables attackers to obscure harmful function calls, such as system() and exec(), thereby evading the application's security controls.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where SuiteCRM is hosted, with the executed commands running under the web server's user privileges.

Remediation

Users can upgrade to SuiteCRM versions 7.15.1 or 8.9.3, both of which address this vulnerability.