CVE-2022-50589 - Vulnerability Details - OpenCVE

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/
https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6
https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality

History

Thu, 06 Nov 2025 20:15:00 +0000

Type	Values Removed	Values Added
Description		SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.
Title		SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality
Weaknesses		CWE-89
References		https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/ https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6 https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2025-11-06T19:59:12.520Z

Updated: 2025-11-06T20:27:20.421Z

Reserved: 2025-11-05T14:54:49.234Z

Link: CVE-2022-50589

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-11-06T20:15:36.787

Modified: 2025-11-06T20:15:36.787

Link: CVE-2022-50589

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50589", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-11-05T14:54:49.234Z", "datePublished": "2025-11-06T19:59:12.520Z", "dateUpdated": "2025-11-06T20:27:20.421Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["\u2018export\u2019 functionality", "\u2018uid\u2019 parameter"], "product": "SuiteCRM", "repo": "https://github.com/SuiteCRM/SuiteCRM", "vendor": "SuiteCRM", "versions": [{"lessThan": "7.12.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Exodus Intelligence"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the \u2018uid\u2019 parameter within the \u2018export\u2019 functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code."}], "value": "SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the\u00a0processing of the \u2018uid\u2019 parameter within the \u2018export\u2019 functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2025-11-06T19:59:12.520Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6"}, {"tags": ["technical-description"], "url": "https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2022-06-09T16:00:00.000Z", "value": "Exodus Intelligence publicly discloses technical details of vulnerability."}, {"lang": "en", "time": "2022-05-24T16:00:00.000Z", "value": "SuiteCRM releases patched version - 7.12.6."}], "title": "SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-06T20:27:11.120632Z", "id": "CVE-2022-50589", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-06T20:27:20.421Z"}}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the\u00a0processing of the \u2018uid\u2019 parameter within the \u2018export\u2019 functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code."}], "id": "CVE-2022-50589", "lastModified": "2025-11-06T20:15:36.787", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2025-11-06T20:15:36.787", "references": [{"source": "disclosure@vulncheck.com", "url": "https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/"}, {"source": "disclosure@vulncheck.com", "url": "https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}