CVE-2025-54788

Estado: AnalizadaAlta (8.8)—

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.42%
Percentil entre todas las CVEs puntuadas: 34
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1499 Endpoint Denial of Serviceimpact75 %
Impacto secundarioT1565.001 Stored Data Manipulationimpact85 %

SQL injection en módulo InboundEmail (CWE-89) de SuiteCRM accesible con PR:L permite extraer, modificar y eliminar datos de BD; explotación remota con autenticación (T1210) que impacta confidencialidad, integridad y disponibilidad.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Threat Intelligence Program Restrict File and Directory Permissions Privileged Account Management Remote Data Storage Network Segmentation

Tecnologías afectadas (1)

Salesagility — Suitecrm

CWE

CWE-89

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-54788",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-54788",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-07T14:45:07.725896Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "SuiteCRM",
          "product": "SuiteCRM",
          "versions": [
            {
              "status": "affected",
              "version": "< 7.14.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-07T00:15:32.697",
  "references": [
    {
      "url": "https://docs.suitecrm.com/admin/releases/7.14.x/#_7_14_7",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-v3m9-8wg7-c72x",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7."
    },
    {
      "lang": "es",
      "value": "SuiteCRM es una aplicación de software de gestión de relaciones con los clientes (CRM) de código abierto y lista para empresas. En las versiones 7.14.7 y anteriores, el módulo InboundEmail permite la ejecución arbitraria de consultas en la base de datos backend, lo que provoca una inyección SQL. Esto puede tener importantes implicaciones para la confidencialidad, la integridad y la disponibilidad, ya que los datos de la base de datos pueden recuperarse, modificarse o eliminarse por completo. Este problema se solucionó en la versión 7.14.7."
    }
  ],
  "lastModified": "2026-06-17T09:40:42.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:salesagility:suitecrm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6F10A9B-760C-4AAF-AC40-FD707DB4453F",
              "versionEndExcluding": "7.14.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}