The vulnerability lies in the Project Template module’s action_get_end_date function, where task_id and lag POST parameters are interpolated directly into an SQL query without any sanitization, escaping, or parameterization. An attacker who is already authenticated can exploit this blind SQL injection to read database contents, including customer data, internal communications, and user credentials.

The issue affects all installations of SuiteCRM running versions older than 7.15.2 and 8.10.2. Any system using the Project Template module that accepts task_id and lag inputs is vulnerable, regardless of the specific configuration or deployment environment.

With a CVSS score of 6.5, the vulnerability presents a moderate severity risk. The EPSS score is not available, and the defect is not listed in CISA’s KEV catalog. The attack requires the attacker to be an authenticated user, after which the SQL injection permits read‑only extraction of sensitive data. No privilege escalation or remote code execution is provided by the flaw itself, but the loss of confidentiality could be significant for an organization using SuiteCRM.