CVE-2019-25664

HighPublic PoC

Published: 05 April 2026

Published

05 April 2026

Modified

20 April 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS Score 0.0006 18.0th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2019-25664 is a high-severity SQL Injection (CWE-89) vulnerability in Salesagility Suitecrm. Its CVSS base score is 7.1 (High).

Operationally, ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mitigates the SQL injection by validating the unsanitized 'record' parameter before its use in database queries within the Users module DetailView action.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and patching of the specific flaw in SuiteCRM 7.10.7 that enables time-based blind SQL injection.

SI-9 Information Input Restrictions good match

prevent

Enforces restrictions and scanning on information inputs like the 'record' parameter in GET requests to block malicious SQL payloads.

NVD Description

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the…

index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.

Deeper analysisAI

CVE-2019-25664 is a time-based SQL injection vulnerability (CWE-89) in SuiteCRM 7.10.7. The issue affects the record parameter in the Users module DetailView action, where insufficient sanitization allows attackers to manipulate database queries via crafted input.

Authenticated attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By appending SQL code to the record parameter in GET requests to the index.php endpoint, they can perform time-based blind SQL injection to extract sensitive database information. The vulnerability yields high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N), resulting in a CVSS v3.1 base score of 7.1 (S:U).

Mitigation guidance and patch information can be found in advisories such as the VulnCheck advisory at https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter, the official SuiteCRM site at https://suitecrm.com/, and its download page at https://suitecrm.com/download/. A proof-of-concept exploit is publicly available at https://www.exploit-db.com/exploits/46311.