The vulnerability is a time‑based blind SQL injection in the REST API v4.1 get_entry_list method of SuiteCRM. By sending specially crafted payloads, an attacker can cause the application to execute arbitrary SQL statements and read data from the database. The impact is the disclosure of sensitive information stored in the CRM, such as customer records, and it is classified as a SQL injection weakness (CWE‑89).

SuiteCRM versions earlier than 7.15.2 and 8.10.2 are affected. The REST API in these releases is exposed to authenticated callers who can bypass two independent security mechanisms, allowing the injection to be performed.

The CVSS score of 8.3 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting it may not yet be widely exploited. Successful exploitation requires authentication and a path to bypass two security controls; the likely attack vector is an authenticated user interacting with the REST API from an external or trusted network. Once exploited, the attacker can extract confidential database contents.