| Package | Affected versions | Patched versions |
|---|---|---|
| suitecrm | ≥ 8.6.0, < 8.9.1 | 8.9.1 |
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free