SuiteCRM SQL Injection Flaws (CVE-2025-64492, CVE-2025-64493) Expose Customer Data

The maintainers of SuiteCRM have issued an urgent security update addressing two SQL injection flaws, CVE-2025-64492 and CVE-2025-64493, that could allow authenticated users to extract sensitive data from backend databases. The flaws affect SuiteCRM versions up to and including 8.9.0 and have been patched in version 8.9.1.

CVE-2025-64492 is a time-based blind SQL injection vulnerability with a high severity (CVSS 8.8) that could enable an authenticated attacker to enumerate database, table and column names and to extract sensitive data including hashed passwords and customer details, with potential privilege escalation or remote code execution in certain configurations.

The second issue, CVE-2025-64493, affects the GraphQL API in the appMetadata operation, and is a medium-severity time-based blind SQL injection that does not require administrative privileges and could allow a logged-in user to exfiltrate confidential information. According to the advisory, both flaws have been fixed in 8.9.1, and users are urged to upgrade promptly to mitigate the risk.