SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

Summary

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.

Remediation

1. Inventory every SuiteCRM SuiteCRM deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-5m7h-v4v6-2r8h
• Referencehttps://github.com/SuiteCRM/SuiteCRM-Core/commit/a11f50180d939f639cc468b5d536e8ad714dfb68
• Referencehttps://github.com/SuiteCRM/SuiteCRM/commit/d6bca97a0159ec019a969b86eca32affab3beb7c
• Referencehttps://github.com/SuiteCRM/SuiteCRM-Core/releases/tag/v8.10.2
• Referencehttps://github.com/SuiteCRM/SuiteCRM/releases/tag/v7.15.2