CVE-2026-97377

Summary

A blind SQL injection flaw exists in SuiteCRM's legacy SOAP portal method 'portal_get_entry_list' due to unsanitized user-controlled 'where' and 'order_by' parameters being directly used in SQL queries, allowing a low-privileged attacker to extract sensitive data and manipulate query behavior.

Exploitability

Exploitation requires valid low-privileged portal API credentials but is otherwise straightforward due to lack of input sanitization.

Blast radius

Successful exploitation could lead to full database compromise including customer data, internal notes, and CRM metadata, enabling data exfiltration, account manipulation, or service disruption via resource exhaustion.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SuiteCRM version 7.15.2 or 8.10.2, where the vulnerability is patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.