SuiteCRM SQL Injection Vulnerability in Authentication Module Allowing Privilege Escalation

A SQL injection vulnerability has been identified in SuiteCRM authentication mechanisms, specifically in versions prior to 7.15.1 and 8.9.3, when directory support is enabled. The vulnerability arises because the application does not properly sanitize user-supplied usernames before incorporating them into local database queries. This flaw allows an attacker with valid, low-privilege directory credentials to execute arbitrary SQL commands, potentially leading to complete privilege escalation, such as gaining access as the CRM Administrator.

Impact

Exploitation of this vulnerability allows for authenticated SQL injection, with the potential for privilege escalation to the CRM Administrator role.

Remediation

Users can upgrade to SuiteCRM versions 7.15.1 or 8.9.3 to address this vulnerability.