SuiteCRM 7.10.7 is vulnerable to a time‑based blind SQL injection in the Users module DetailView action. An authenticated user can inject SQL code into the record parameter of GET requests to index.php. The injected statements delay the database response, enabling an attacker to glean sensitive database contents without directly observing output. The vulnerability allows unauthorized extraction of confidential data stored in the database, potentially compromising data integrity and confidentiality.

SuiteCRM version 7.10.7. The affected product is SuiteCRM’s Users module accessed via the DetailView action when authenticated. No other product versions or vendors are listed.

The CVSS score of 7.1 indicates a high severity. While EPSS data is not available, the lack of official exploitation reports and the absence from the KEV catalog reduce immediate exploitation likelihood, yet the requirement for authentication means the attack vector is internal or limited to compromised user accounts. Compared to public or remote exploits, the risk remains significant for organizations using this version.