SuiteCRM versions earlier than 7.15.1 and 8.9.3 allow an attacker who is authenticated and has Reports section access to craft an HTTP POST request that includes a malicious value for the field_function parameter when creating or editing a report. That value is stored directly in the aor_fields table and later concatenated without sanitization into a SQL SELECT statement. The resulting second‑order SQL injection can be used to retrieve arbitrary data such as password hashes, API tokens, and configuration values; if the underlying MySQL instance has FILE privilege, an attacker could achieve remote code execution via SELECT INTO OUTFILE. The vulnerability is a classic example of CWE‑89, directly impacting the confidentiality and integrity of the database and potentially the availability of the application if a destructive query is executed.

All installations of SuiteCRM built from source or following the official distribution that run the AOR_Reports module versions prior to 7.15.1 and 8.9.3 are affected. This includes SuiteCRM releases up to 7.15.0 and 8.9.2, respectively. Administrators should verify their installed version against the patch information documented in the SuiteCRM release notes and upgrade to at least 7.15.1 or 8.9.3.

The CVSS score of 8.1 indicates a high severity situation, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a web application interface where an authenticated user submits report data via HTTP POST. Successful exploitation requires the ability to create or edit reports, which in turn requires appropriate permissions. If a MySQL user with FILE privilege is used by the application, the impact escalates to potential remote code execution. Administration of database privileges and proper input validation can mitigate the risk, but the preferred solution is an update to a patched version.