CVE-2022-50589

An attacker sends a specially crafted export request, injecting malicious SQL code into the 'uid' parameter without needing to have any account in the system. The application does not properly validate or sanitize this value before passing it to the database query. Successful exploitation of a CWE-89 class vulnerability (SQL injection) leads to privilege escalation at the database level, and as a result to the execution of arbitrary code on the server (RCE).

An unauthenticated attacker can gain full control over the application server through remote code execution of arbitrary code, as well as gain access to all data stored in the database — including customer data and business information.

SuiteCRM should be immediately updated to version 7.12.6 or newer, according to the information in the official release notes from the vendor (https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6). Until the patch is implemented, it is recommended to restrict network access to data export functions at the firewall or web server level.

Salesagility SuiteCRM in versions earlier than 7.12.6