Introduction
Unauthorized access to customer data and business records can disrupt operations and expose organizations to regulatory penalties. CVE-2025-54788 is a critical SQL injection vulnerability in SuiteCRM's InboundEmail module. It lets attackers run arbitrary queries against the backend database in affected deployments.
SuiteCRM is an open-source, enterprise-focused CRM platform developed by SalesAgility. Companies across many industries use it to manage customer relationships, sales pipelines, and business communications. Because it is flexible and inexpensive, it is a common pick for organizations looking for an alternative to proprietary CRM products. SuiteCRM holds sensitive business and personal data for millions of users worldwide.
Technical information
CVE-2025-54788 is a SQL injection vulnerability in the InboundEmail module of SuiteCRM. The flaw is present in all SuiteCRM versions up to and including 7.14.6. The cause is improper input validation. The module puts user-supplied data directly into SQL queries without adequate sanitization or parameterization, so an attacker can inject SQL statements that the backend database executes with the application's privileges.
The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command. An attacker who exploits it can:
- Retrieve sensitive data from the database
- Modify or delete database records
- Potentially execute administrative operations, depending on database permissions
No public code snippets or detailed exploit payloads are available for this vulnerability. The root cause is the lack of proper input handling where the InboundEmail module interacts with the database.
Affected systems and versions
- Product: SuiteCRM
- Module: InboundEmail
- Affected versions: 7.14.6 and all earlier versions
- Fixed in: 7.14.7
Any deployment running SuiteCRM 7.14.6 or an earlier version is vulnerable if the InboundEmail module is enabled and exposed.
Vendor security history
SalesAgility, the developer of SuiteCRM, has fixed several SQL injection and input validation vulnerabilities in recent years. One of them, CVE-2024-36412, was a critical SQL injection issue in the events response entry point. The vendor typically patches promptly and publishes public advisories. Even so, the repeated appearance of similar flaws suggests ongoing problems with secure development practices and input validation across the codebase.
