CVE-2024-49773

Summary

CVE-2024-49773 is a vulnerability affecting SuiteCRM, an open-source CRM software. This issue stems from poor input validation in the export function, enabling authenticated users to execute SQL injection attacks. The `current_post` parameter is the entry point for this vulnerability, which can be exploited via `generateSearchWhere()` to perform blind SQL injections. The attack allows for data disclosure, potentially exposing personally identifiable information. Affected users are advised to upgrade to SuiteCRM versions 7.14.6 and 8.7.1 to mitigate this risk. No known workarounds are available for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.