CVE-2025-64493 - CVE House
Back to Database
Status published Medium CVE-2025-64493

SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

Vulnerability Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind (time-based) SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the database, and does not require administrative access. This issue is fixed in version 8.9.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64493

Credits & Attribution

No credits recorded in the NVD database.

References

More from SuiteCRM

View All →
CVE-2025-64492
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
High 8.8
CVE-2025-64491
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
Medium 6.1
CVE-2025-64490
SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
High 8.3
CVE-2025-64489
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
High 8.3
CVE-2025-64488
SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module
High 8.6

Affected Vendor

Affected Software

SuiteCRM-Core
Vulnerable Versions:
>= 8.6.0, < 8.9.1

Timeline

Official Publish: November 8th, 2025
Last Modified: November 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact