Security Flaw in SuiteCRM Allows Malicious Code Execution

CVE-2024-49774

Summary

SuiteCRM, a popular open-source Customer Relationship Management software, is affected by a security flaw that allows attackers to bypass security measures designed to prevent the execution of malicious PHP scripts. This vulnerability stems from the improper parsing of PHP scripts using the token_get_all function, which fails to account for certain syntax structures in the Abstract Syntax Tree (AST) that could circumvent blacklist restrictions. Users of SuiteCRM are strongly advised to upgrade to versions 7.14.6 or 8.7.1 or later, as no effective workarounds exist to mitigate this risk. The flaw highlights the critical need for comprehensive security protocols in open-source applications.

References