CVE-2022-50589: SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-06 · updated 2026-07-15
Weakness: CWE-89

Description

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

Affected products

salesagility SuiteCRM: before 7.12.6 — fixed in 7.12.6

How to fix

Upgrade to a fixed version: salesagility SuiteCRM 7.12.6. Check the vendor advisory for mitigations.

References

https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/
https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6
https://www.vulncheck.com/advisories/suitecrm-sqli-via-export-functionality

Get alerted when CVE-2022-50589 or the next vulnerability affects your stack