salesagility suitecrm Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Published September 10, 2026 CVE-2024-36412

SuiteCRM is a customer relationship management program many businesses use to track sales and customers. A flaw let an outsider break into its database without logging in, reading, changing, or destroying customer records just by sending a crafted web request.

Severity
CriticalCVSS 3.1 · 10.0 · github.com
Fix
Fixed in 7.14.4
Affected versions
before 7.14.4; 8.0.0 or newer, but before 8.6.1
Weakness
CWE-89SQL Injection
Exploit likelihood
5.7% in 30 daysEPSS, higher than 93% of known flaws
Affects
SuiteCRM
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: total
EU ID
EUVD-2024-36069ENISA vulnerability database

How it works

  • SuiteCRM has a part of its website code that handles responses to calendar or meeting events.
  • That code takes a piece of data from the incoming web request and drops it straight into a database command instead of treating it as plain text.
  • An attacker can shape that piece of data so the database runs the attacker's own instructions instead of the intended one.
  • Because this entry point does not require logging in first, anyone who can reach the SuiteCRM website over the internet can try it.

What to do

Check your SuiteCRM version in the admin panel or the application's version file, since this affects builds before 7.14.4 on the 7.x line and 8.0.0 up to 8.6.0 on the 8.x line. Compare the number you find against those cutoffs to see if your installation falls in the affected range.

Update to SuiteCRM 7.14.4 if you run the 7.x line, or to 8.6.1 if you run the 8.x line, since both releases contain the fix. Review the GitHub security advisory for full version details if you manage a customized or older deployment.

Technical details

CVE-2024-36412 is an unauthenticated SQL injection in SuiteCRM's events response entry point, tracked under CWE-89. User-controlled input reaches a database query without proper neutralization, letting a remote, unauthenticated attacker manipulate the query. CVSS 3.1 scores it 10.0 (critical), with network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability due to a scope change. Fixed in SuiteCRM 7.14.4 and 8.6.1; affected ranges are below 7.14.4 and 8.0.0 up to below 8.6.1.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source