SuiteCRM versions prior to 7.15.1 and 8.9.3 are vulnerable to a second-order SQL injection flaw that allows authenticated users to compromise database integrity and potentially execute arbitrary code.

This is a second-order SQL injection vulnerability occurring in the AOR_Reports module, where the field_function parameter is improperly sanitized before being saved to the database and subsequently executed in a SQL query. The vulnerability requires the attacker to be an authenticated user with access to the Reports module.

The vulnerability carries a CVSS score of 8.1, indicating a high severity risk. Successful exploitation allows authenticated users to gain unauthorized access to sensitive information, such as password hashes, API tokens, and configuration values. In environments where the underlying MySQL database is configured with the FILE privilege, an attacker may escalate this vulnerability to achieve remote code execution, leading to a full system compromise.

Immediate Action: Upgrade SuiteCRM to version 7.15.1 or 8.9.3 immediately to incorporate the necessary input validation and query sanitization patches.

Proactive Monitoring: Review database access logs for anomalous SQL queries or unexpected usage of the SELECT INTO OUTFILE command, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns within POST requests targeting the AOR_Reports module.

Public Exploit Available: Unknown

Given the potential for complete database compromise and escalation to remote code execution, this vulnerability poses a significant risk to organizational security. Administrators must prioritize the application of the vendor-supplied patches for versions 7.15.1 and 8.9.3. If immediate patching is not feasible, restrict access to the Reports module for all non-essential users to minimize the attack surface.