CVE-2019-25663

HIGH

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-25663. PoCs published by Mehmet EMIROGLU.

AI-analyzed exploit summary The exploit demonstrates a SQL injection vulnerability in SuiteCRM 7.10.7 via the 'parentTab' parameter. It provides a boolean-based SQLi payload and a crafted GET request to trigger the vulnerability, confirming the presence of the flaw.

Description

SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection techniques to extract sensitive database information.

Exploits (1)

exploitdb WORKING POC
by Mehmet EMIROGLU · textwebappsphp
https://www.exploit-db.com/exploits/46310

The exploit demonstrates a SQL injection vulnerability in SuiteCRM 7.10.7 via the 'parentTab' parameter. It provides a boolean-based SQLi payload and a crafted GET request to trigger the vulnerability, confirming the presence of the flaw.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: SuiteCRM 7.10.7
Auth required
Prerequisites: Authenticated access to SuiteCRM · Access to the Emails module
devstral-2 · analyzed Apr 07, 2026 Full analysis →

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-46310
https://www.exploit-db.com/exploits/46310
Product product
Official Product Homepage
https://suitecrm.com/
Product product
Product Reference
https://suitecrm.com/download/
Third Party Advisory third-party-advisory
VulnCheck Advisory: SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-parenttab-parameter

Scores

CVSS v3 7.1
EPSS 0.0034
EPSS Percentile 25.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
salesagility/suitecrm < 7.10.7
Suitecrm/SuiteCRM 7.10.7
Published Apr 05, 2026
Tracked Since Apr 06, 2026