SuiteCRM: Authenticated SQL Injection In Project Module
Affects SuiteCRM 8.0.0 through 8.10.1 and all versions before 7.15.2, via the Project module's Save.php duplicateId parameter. Fixed in 7.15.2 and 8.10.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 7.15.2, 8.10.2
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. The vulnerable endpoint is the Project module Save.php, which takes the duplicateId POST parameter.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 15/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
SuiteCRM, an open-source customer relationship management application, is affected by an SQL injection flaw in its Project module. An attacker who can reach the application over the network and log in with a low-privilege account can manipulate the database query through the duplicateId parameter and read sensitive database information.
Read the original description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity7.1/10CVSS 7.1
- No patch0/5No signal
What would change the score
- Would score about 65 if added to CISA KEV
- Would score about 60 if CISA's SSVC rates exploitation active
- Would score about 22 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
The vulnerable endpoint is the Project module Save.php, which takes the duplicateId POST parameter.Upgrade to a fixed version: 7.15.2, 8.10.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- SuiteCRM SuiteCRM
fixed in 7.15.2; From 8.0.0 · fixed in 8.10.2
Evidence 5
- Advisory
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-69135
Is CVE-2026-69135 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
An logged-in user can send a crafted duplicateId value to the Project module's Save.php, which lets them run database queries they should not be able to run. Through this, sensitive data such as administrator credentials can be extracted, and the application may be fully taken over.Source: github.com
Which versions are affected by CVE-2026-69135?
SuiteCRM: before 7.15.2; from 8.0.0 before 8.10.2.Source: cve.now feed data
Am I affected, and how do I check?
SuiteCRM versions before 7.15.2 and versions from 8.0.0 up to but not including 8.10.2 are affected. Check the installed version in the admin area or in the version file of your installation; the issue applies only to users who have an account able to use the Project module.Source: github.com
How do I fix CVE-2026-69135?
Upgrade to SuiteCRM 7.15.2 if you run the 7.x line, or to 8.10.2 if you run the 8.x line. No workaround is listed in the facts, so the patched release is the fix.Source: github.com