Security Flaw in SuiteCRM Allows Malicious Code Execution

CVE-2024-49774

What is CVE-2024-49774?

SuiteCRM, a popular open-source Customer Relationship Management software, is affected by a security flaw that allows attackers to bypass security measures designed to prevent the execution of malicious PHP scripts. This vulnerability stems from the improper parsing of PHP scripts using the token_get_all function, which fails to account for certain syntax structures in the Abstract Syntax Tree (AST) that could circumvent blacklist restrictions. Users of SuiteCRM are strongly advised to upgrade to versions 7.14.6 or 8.7.1 or later, as no effective workarounds exist to mitigate this risk. The flaw highlights the critical need for comprehensive security protocols in open-source applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References