Skip to content
Heist/ feed
Back to feed
High

SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module

Type: advisorySources: OSV

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-54788
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 21:07 UTC · Revision 1

Source evidence

SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module

core-osv · Original source

Published 6 Aug 2025, 23:48 UTC

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

osv:CVE-2025-54788
Complete source record
{
  "id": "82012c45d1b6a9b4467afdbf991ac13aa0d1cc3684b42eafda8d5ac6acca94ad",
  "url": "https://osv.dev/vulnerability/CVE-2025-54788",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module",
    "summary": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.",
    "evidence": "osv:CVE-2025-54788",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-54788",
      "aliases": [
        "CVE-2025-54788",
        "GHSA-v3m9-8wg7-c72x"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/suitecrm/suitecrm",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "55921fe6c5fd5e2f81fc401e2d9ac8653cfbb8b5"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.14.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "7.14.7"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v7.14.6",
            "v7.14.5",
            "v7.14.4",
            "v7.14.3",
            "v7.14.2",
            "v7.14.1",
            "v7.14.0",
            "v7.14.0-beta",
            "v7.13.4",
            "v7.13.3",
            "v7.13.2",
            "v7.13.1",
            "v7.13.0",
            "v7.12.8",
            "v7.13.0-beta",
            "v7.12.7",
            "v7.12.6",
            "v7.12.5",
            "v7.12.4",
            "v7.12.3",
            "v7.12.2",
            "v7.12.1",
            "v7.12.0",
            "v7.12-rc",
            "v7.11.18",
            "v7.11.17",
            "v7.11.16",
            "v7.11.15",
            "v7.11.14",
            "v7.11.13",
            "v7.11.12",
            "v7.11.11",
            "v7.11.8",
            "v7.11.7",
            "v7.11.6",
            "v7.11.5",
            "v7.11.4",
            "v7.11.3",
            "v7.11.2",
            "v7.10.12",
            "v7.11.1",
            "v7.11.0",
            "v7.10.11",
            "v7.10.10",
            "v7.10.5",
            "v7.10.7",
            "v7.10.4",
            "v7.10.6",
            "v7.10.1",
            "v7.10.3",
            "v7.10.2",
            "v7.10.0",
            "v7.9.14",
            "v7.9.13",
            "v7.9.12",
            "v7.9.11",
            "v.7.9.11",
            "v7.9.10",
            "v7.9.8",
            "v7.9.4",
            "7.9.6",
            "v7.9.5",
            "v7.9.3",
            "v7.9.1",
            "v7.9.0",
            "v7.9.0-rc",
            "v7.9.0-beta",
            "v7.8.2",
            "v7.8.1",
            "v7.8.0",
            "v7.8.0-rc",
            "v7.8.0-beta.2",
            "v7.8.0-beta",
            "v7.7.4",
            "v7.7.3",
            "v7.7.2",
            "v7.7",
            "v7.7-rc2",
            "v7.7-rc",
            "v7.7-beta2",
            "v7.7-beta1",
            "v7.6.1",
            "v7.6",
            "v7.5.1",
            "v7.5-beta.2",
            "v7.4.3",
            "v7.5-beta",
            "v7.4.1",
            "v7.4.2",
            "v7.3.2",
            "v7.3.1",
            "v7.3",
            "v7.3-beta",
            "v7.2",
            "v7.2.1",
            "v7.1.3",
            "v7.2beta2",
            "v7.1.4",
            "v7.2beta",
            "v7.1.2",
            "v7.1.1",
            "v7.1",
            "v7.0.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-54788.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.533566576Z",
      "provider": "osv",
      "references": [
        "https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54788.json",
        "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-54788"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-89"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54788.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-54788",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520412,
  "published_at": "2025-08-06T23:48:55.847+00:00"
}