SuiteCRM Open Redirect Vulnerability in WebToLead Capture Functionality

An unauthenticated open redirect vulnerability has been identified in SuiteCRM versions prior to 7.15.1 and 8.9.3. The issue arises in the WebToLead capture functionality, where a user-supplied POST parameter is used as a redirect destination without proper validation. This flaw allows attackers to redirect victims to arbitrary external websites, potentially leading to phishing and social engineering attacks that exploit the trusted SuiteCRM domain.

Impact

Exploitation of this vulnerability could be used for phishing and social engineering attacks, redirecting users to malicious external websites while masking the threat under the trusted SuiteCRM domain.

Remediation

Users can upgrade to SuiteCRM versions 7.15.1 or 8.9.3 to address this vulnerability.