CVE-2026-69142

Summary

An authenticated SQL injection flaw exists in SuiteCRM's jjwg_Maps map marker endpoint due to insufficient validation of the distance parameter, allowing attackers to manipulate SQL queries and access or modify sensitive database content.

Exploitability

Exploitation requires valid authentication but no elevated privileges, and the vulnerability is straightforward to exploit given public proof-of-concept references.

Blast radius

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of the CRM system and its underlying data, including customer records and internal operations.

Detection

Look for SQL syntax errors or unexpected patterns in application logs related to the map_markers endpoint, especially when non-numeric values are passed in the distance field; also monitor for unusual database query durations or resource spikes on the application server.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2, where the issue is fixed by implementing strict numeric validation and parameterization of the distance parameter.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.