Description
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.
Affected products
salesagility: suitecrm
References4
- www.exploit-db.com/exploits/46311 ExploitThird Party AdvisoryVDB Entry
- suitecrm.com/ Product
- suitecrm.com/download/ Product
- www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-… Third Party Advisory
Metrics
- CVSS 3.1
-
7.1
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - CVSS 4.0
-
7.1
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 30 · as of 12 November 2026
- CWE
- CWE-89
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.