CVE-2025-54788 - CVE House
Back to Database
Status published High CVE-2025-54788

SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows the arbitrary execution of queries in the backend database, leading to SQL injection. This can have wide-reaching implications on confidentiality, integrity, and availability, as database data can be retrieved, modified, or removed entirely. This issue is fixed in version 7.14.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54788

Credits & Attribution

No credits recorded in the NVD database.

References

More from SuiteCRM

View All →
CVE-2025-64493
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Medium 6.5
CVE-2025-64492
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
High 8.8
CVE-2025-64491
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
Medium 6.1
CVE-2025-64490
SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
High 8.3
CVE-2025-64489
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
High 8.3

Affected Vendor

Affected Software

SuiteCRM
Vulnerable Versions:
< 7.14.7

Timeline

Official Publish: August 6th, 2025
Last Modified: August 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact