SQL Injection Vulnerability in SuiteCRM AOR Reporting Module

CVE-2026-100365

What is CVE-2026-100365?

An SQL injection vulnerability exists in the AOR Reports module of SuiteCRM, where user-controlled input is improperly handled. Prior to versions 7.15.2 and 8.10.2, the application concatenates attacker-controlled field labels into an ORDER BY clause without proper validation. This enables authenticated users with access to AOR Reports to potentially execute unauthorized queries, extracting sensitive data such as password hashes and other table entries, while also allowing them to maintain expensive database connections. The vulnerability has been addressed in the latest releases.

References