Critical
SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
Type: advisorySources: OSV
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-36410
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 06:19 UTC · Revision 1
Source evidence
SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
core-osv · Original sourcePublished 10 Jun 2024, 17:24 UTC
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
osv:CVE-2024-36410
Complete source record
{
"id": "3a270fc34aaa3dd18b91eb9432bfc022af77db54b90683a4f15272b2cc4179e5",
"url": "https://osv.dev/vulnerability/CVE-2024-36410",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller",
"summary": "SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.",
"evidence": "osv:CVE-2024-36410",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2024-36410",
"aliases": [
"BIT-suitecrm-2024-36410",
"CVE-2024-36410",
"GHSA-7jj8-m2wj-m6xq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/SuiteCRM/SuiteCRM",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "504d6f0ebd5847169d73c52d312e91916a7280bb"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "7.14.4"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.14.4"
}
],
"source": "CPE_RANGE"
}
]
}
},
{
"repo": "https://github.com/SuiteCRM/SuiteCRM-Core",
"type": "GIT",
"events": [
{
"introduced": "55c1ee9cbdf409ed41c04da0bbf442b311a3ab57"
},
{
"fixed": "f483bec4cffb267840725af5c022a7e8f2599934"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v7.14.3",
"v7.14.2",
"v7.14.1",
"v7.14.0",
"v7.14.0-beta",
"v7.13.4",
"v7.13.3",
"v7.13.2",
"v7.13.1",
"v7.13.0",
"v7.12.8",
"v7.13.0-beta",
"v7.12.7",
"v7.12.6",
"v7.12.5",
"v7.12.4",
"v7.12.3",
"v7.12.2",
"v7.12.1",
"v7.12.0",
"v7.12-rc",
"v7.11.18",
"v7.11.17",
"v7.11.16",
"v7.11.15",
"v7.11.14",
"v7.11.13",
"v7.11.12",
"v7.11.11",
"v7.11.8",
"v7.11.7",
"v7.11.6",
"v7.11.5",
"v7.11.4",
"v7.11.3",
"v7.11.2",
"v7.10.12",
"v7.11.1",
"v7.11.0",
"v7.10.11",
"v7.10.10",
"v7.10.5",
"v7.10.7",
"v7.10.4",
"v7.10.6",
"v7.10.1",
"v7.10.3",
"v7.10.2",
"v7.10.0",
"v7.9.14",
"v7.9.13",
"v7.9.12",
"v7.9.11",
"v.7.9.11",
"v7.9.10",
"v7.9.8",
"v7.9.4",
"7.9.6",
"v7.9.5",
"v7.9.3",
"v7.9.1",
"v7.9.0",
"v7.9.0-rc",
"v7.9.0-beta",
"v7.8.2",
"v7.8.1",
"v7.8.0",
"v7.8.0-rc",
"v7.8.0-beta.2",
"v7.8.0-beta",
"v7.7.4",
"v7.7.3",
"v7.7.2",
"v7.7",
"v7.7-rc2",
"v7.7-rc",
"v7.7-beta2",
"v7.7-beta1",
"v7.6.1",
"v7.6",
"v7.5.1",
"v7.5-beta.2",
"v7.4.3",
"v7.5-beta",
"v7.4.1",
"v7.4.2",
"v7.3.2",
"v7.3.1",
"v7.3",
"v7.3-beta",
"v7.2",
"v7.2.1",
"v7.1.3",
"v7.2beta2",
"v7.1.4",
"v7.2beta",
"v7.1.2",
"v7.1.1",
"v7.1",
"v7.0.2",
"v8.6.0",
"v8.5.1",
"v8.5.0",
"v8.4.2",
"v8.4.1",
"v8.4.0",
"v8.4.0-beta",
"v8.3.1",
"v8.3.0",
"v8.2.4",
"v8.2.3",
"v8.2.2",
"v8.2.1",
"v8.2.0",
"v8.2.0-beta.2",
"v8.1.3",
"v8.1.2",
"v8.1.1",
"v8.1.0",
"v8.0.4",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36410.json"
}
}
],
"modified": "2026-10-28T02:30:49.803794949Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36410.json",
"https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-7jj8-m2wj-m6xq",
"https://nvd.nist.gov/vuln/detail/CVE-2024-36410"
],
"provider_metadata": {
"cwe_ids": [
"CWE-89"
],
"cna_assigner": "GitHub_M",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.6.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36410.json"
}
},
"related_cves": [
{
"value": "CVE-2024-36410",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518475,
"published_at": "2024-06-10T17:24:08.514+00:00"
}