CVE-2025-64493
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Summary
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Original description
The description as published by the source.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web docs.suitecrm.com