CVE-2019-25663

HIGH

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

Title source: cna
STIX 2.1

Description

SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection techniques to extract sensitive database information.

Exploits (1)

exploitdb WORKING POC
by Mehmet EMIROGLU · textwebappsphp
https://www.exploit-db.com/exploits/46310

References (4)

Core 4
Core References
Exploit exploit
ExploitDB-46310
https://www.exploit-db.com/exploits/46310
Product product
Official Product Homepage
https://suitecrm.com/
Product product
Product Reference
https://suitecrm.com/download/
Third Party Advisory third-party-advisory
VulnCheck Advisory: SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-parenttab-parameter

Scores

CVSS v3 7.1
EPSS 0.0005
EPSS Percentile 15.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
salesagility/suitecrm < 7.10.7
Suitecrm/SuiteCRM 7.10.7
Published Apr 05, 2026
Tracked Since Apr 06, 2026