CVE-2019-25664

Katalog CVE

CVSS 7.1 · High EPSS 0,34%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada salesagility suitecrm. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

Rincian

Terbit di NVD

5 April 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/46311 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter advisory pihak ketiga
• https://suitecrm.com/ product
• https://suitecrm.com/download/ product