CVE-2026-100365

Summary

A SQL injection flaw in SuiteCRM's AOR report generation allows authenticated users to inject arbitrary SQL into ORDER BY clauses by manipulating stored field labels, enabling data exfiltration and denial of service via expensive queries.

Exploitability

Exploitation requires valid authentication and AOR Reports access; no user interaction or special conditions are needed beyond that.

Blast radius

An attacker could extract sensitive database contents—including password hashes and arbitrary table data—and sustain resource exhaustion by submitting expensive ORDER BY expressions.

Detection

Look for unusually long or complex ORDER BY clauses in AOR report SQL logs, especially those containing concatenated field labels or non-standard expressions; also monitor for repeated high-latency report generation requests from the same authenticated user.

Prioritized remediation

Upgrade to SuiteCRM 7.15.2 or 8.10.2, where the issue is fixed; until then, restrict AOR Reports access to trusted users only and validate/sanitize field labels against an allowlist before use in ORDER BY clauses.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.