CVE-2019-25664
Published: 05 April 2026
Summary
CVE-2019-25664 is a high-severity SQL Injection (CWE-89) vulnerability in Salesagility Suitecrm. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2019-25664 is a time-based SQL injection vulnerability (CWE-89) in SuiteCRM 7.10.7. The issue affects the record parameter in the Users module DetailView action, where insufficient sanitization allows attackers to manipulate database queries via crafted input.
Authenticated attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By appending SQL code to the record parameter in GET requests to the index.php endpoint, they can perform time-based blind SQL injection to extract sensitive database information. The vulnerability yields high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N), resulting in a CVSS v3.1 base score of 7.1 (S:U).
Mitigation guidance and patch information can be found in advisories such as the VulnCheck advisory at https://www.vulncheck.com/advisories/suitecrm-sql-injection-via-record-parameter, the official SuiteCRM site at https://suitecrm.com/, and its download page at https://suitecrm.com/download/. A proof-of-concept exploit is publicly available at https://www.exploit-db.com/exploits/46311.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20064
Vulnerability details
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the…
more
index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (SuiteCRM) directly enables T1190 for initial access/exploitation and T1213.006 for extracting data from the backend database.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the SQL injection by validating the unsanitized 'record' parameter before its use in database queries within the Users module DetailView action.
Requires timely identification, reporting, and patching of the specific flaw in SuiteCRM 7.10.7 that enables time-based blind SQL injection.
Enforces restrictions and scanning on information inputs like the 'record' parameter in GET requests to block malicious SQL payloads.