CVE-2025-64488 - CVE House
Back to Database
Status published High CVE-2025-64488

SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64488

Credits & Attribution

No credits recorded in the NVD database.

References

More from SuiteCRM

View All →
CVE-2025-64493
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
Medium 6.5
CVE-2025-64492
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
High 8.8
CVE-2025-64491
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
Medium 6.1
CVE-2025-64490
SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
High 8.3
CVE-2025-64489
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
High 8.3

Affected Vendor

Affected Software

SuiteCRM
Vulnerable Versions:
>= 8.0.0-beta.1, < 8.9.1, < 7.14.8

Timeline

Official Publish: November 7th, 2025
Last Modified: November 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact