Description

SuiteCRM has an SQL Injection vulnerability that allows unauthenticated attackers to gain access to sensitive data and compromise the system.

Remediation

Upgrade to the latest version of SuiteCRM

References

Unauthenticated SQL Injection

CVE-2024-36412 | Proof of Concept

Related Vulnerabilities

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2017-3730)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-4589)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2158)

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-2933)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2010-4698)

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Tags

SQL Injection Known Vulnerabilities CWE-89 CVE-2024-36412