A SQL injection vulnerability in SuiteCRM 7.10.7 allows authenticated attackers to manipulate database queries and extract sensitive information from the backend database.

This vulnerability is a SQL injection flaw located in the parentTab parameter of the email module. An authenticated attacker can send specially crafted GET requests to this module to execute arbitrary SQL commands, resulting in the unauthorized extraction of database content.

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could allow an attacker to dump sensitive customer information, credentials, or other proprietary data stored within the CRM database. With a CVSS score of 7.1, this is a high-severity vulnerability that could lead to full database compromise if the application service account possesses excessive permissions.

Immediate Action: Upgrade to a supported, patched version of SuiteCRM that addresses this SQL injection vulnerability.

Proactive Monitoring: Review web server and application access logs for anomalous GET requests containing SQL syntax, such as sleep commands or boolean logic, directed toward the email module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns in URL parameters, which can provide temporary protection while an upgrade is being scheduled.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry (EDB-ID 46310).

Given the availability of public exploit material, the risk of exploitation is elevated. Administrators should prioritize patching this instance immediately to prevent potential data exfiltration. If an immediate upgrade is not feasible, implement strict input validation or WAF filtering to mitigate the risk until the software can be updated.