SuiteCRM Unsafe Deserialization Vulnerability in SavedSearch Component Allowing Authenticated Remote Code Execution

A vulnerability allowing authenticated administrators to execute arbitrary system commands on the server has been identified in SuiteCRM versions through 8.9.2. This issue arises from unsafe deserialization in the SavedSearch filter processing component, where user-controlled data from the saved_search.contents database column is unserialized without proper restrictions on instantiable classes. The vulnerability has been patched in SuiteCRM version 8.9.3.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server.

Remediation

Users can upgrade to SuiteCRM version 8.9.3 to address this vulnerability.