This vulnerability is an SQL Injection in SuiteCRM’s authentication module that occurs when directory support is enabled. The application fails to sanitize the user-supplied username before it is used in a local database query. An attacker with valid, low-privilege directory credentials can insert malicious SQL and execute arbitrary commands, effectively gaining full administrative access to the CRM system.

Installations of SuiteCRM running versions before 7.15.1 and 8.9.3 are affected. The flaw lies in the authentication handling for directory-enabled logins and applies to any deployment of those unpatched versions.

The CVSS base score of 8.8 marks this issue as high severity, while an EPSS score of less than 1% indicates low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack path requires an attacker to first authenticate with low-privilege directory credentials and then craft a username that triggers the injection; once successful, the attacker can run any SQL statements allowed by the database user, effectively taking over the system.