CVE-2023-5350

published 2023-10-03

CVE-2023-5350: SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.

Priority P2 62 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

EXPLOIT

SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
salesagility	salesagility_suitecrm	>= unspecified < 7.14.1	7.14.1
salesagility	suitecrm	< 7.14.1	7.14.1

Detection & IOCs extracted from sources · hover to see the quote

url /index.php?module=&action=index&searchFormTab=basic_search&query=true&export=true↗

• → Monitor HTTP requests to SuiteCRM's export entry point (index.php with export=true parameter) for anomalous or malformed SQL payloads, particularly from authenticated sessions. ↗
• → Alert on authenticated SuiteCRM sessions issuing export requests that contain SQL metacharacters or UNION/SELECT patterns in query parameters. ↗
• → Flag any SuiteCRM instance running prior to version 7.14.1 (NVD) or 7.12.6 (Metasploit module) as vulnerable and prioritize patching or WAF coverage on the export functionality. ↗

• · There is a version discrepancy between sources: NVD states the vulnerability affects SuiteCRM prior to 7.14.1, while the Metasploit module targets versions before 7.12.6. Ensure detection and patching coverage accounts for the full range up to 7.14.1 as indicated by NVD. ↗
• · Exploitation requires authentication; unauthenticated access alone is not sufficient to trigger this vulnerability. Detection rules should correlate SQL injection indicators with valid authenticated sessions. ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvd v3.0 6.4 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89