Summary
SuiteCRM's jjwg_Maps map marker endpoint uses an authenticated caller's distance value in a database query without strict numeric validation or parameterization. An authenticated attacker may manipulate the query to expose or alter database results and consume server resources.
SuiteCRM's jjwg_Maps map marker endpoint uses an authenticated caller's distance value in a database query without strict numeric validation or parameterization. An authenticated attacker may manipulate the query to expose or alter database results and consume server resources.
Affected context
The issue affects SuiteCRM releases prior to 7.15.2 and 8.10.2. It occurs in the jjwg_Maps map marker endpoint's map_markers action, where the caller-provided distance value is used in a SQL query without strict numeric validation or parameterization.
The issue affects SuiteCRM releases prior to 7.15.2 and 8.10.2. It occurs in the jjwg_Maps map marker endpoint's map_markers action, where the caller-provided distance value is used in a SQL query without strict numeric validation or parameterization.
Exploit preconditions
- Attack surface: The jjwg_Maps map marker endpoint.
- Required access: An authenticated account with access to invoke the affected action.
- Trigger point: Processing the caller-supplied distance value in the map_markers action.
- Why exploitation is possible: The value is incorporated into the SQL query without strict numeric validation or parameterized query handling.
- Attack surface: The jjwg_Maps map marker endpoint.
- Required access: An authenticated account with access to invoke the affected action.
- Trigger point: Processing the caller-supplied distance value in the map_markers action.
- Why exploitation is possible: The value is incorporated into the SQL query without strict numeric validation or parameterized query handling.
Why this happens
The endpoint uses caller-controlled input in SQL query construction without reliably constraining its type or separating data from query syntax. This is a SQL injection weakness (CWE-89): input that should be treated only as a value can instead influence the structure or behavior of a database query.
The endpoint uses caller-controlled input in SQL query construction without reliably constraining its type or separating data from query syntax. This is a SQL injection weakness (CWE-89): input that should be treated only as a value can instead influence the structure or behavior of a database query.
Potential impact
- Sensitive database records may be disclosed.
- Database query results or data may be altered.
- Database resources may be consumed, potentially affecting service availability.
- Sensitive database records may be disclosed.
- Database query results or data may be altered.
- Database resources may be consumed, potentially affecting service availability.
General mitigation guidance
Common defensive patterns for SQL injection risks include:
- Use parameterized queries or prepared statements so caller input remains data rather than query syntax.
- Apply strict server-side type and range validation to values such as distance.
- Avoid relying on client-side validation or escaping as the primary protection.
- Restrict database accounts to the minimum permissions needed by the application.
- Keep database access paths narrow and apply resource limits where appropriate.
Common defensive patterns for SQL injection risks include:
- Use parameterized queries or prepared statements so caller input remains data rather than query syntax.
- Apply strict server-side type and range validation to values such as distance.
- Avoid relying on client-side validation or escaping as the primary protection.
- Restrict database accounts to the minimum permissions needed by the application.
- Keep database access paths narrow and apply resource limits where appropriate.
How teams detect issues like this
High-level approaches to identifying similar issues include:
- Use static analysis to flag SQL statements built through string concatenation or interpolation with request-derived values.
- Review endpoint handlers and database access code for unparameterized inputs and missing server-side type checks.
- Enforce code-review and CI policies requiring parameterized database queries.
- Monitor database errors, unusual query patterns, and unexpected resource consumption associated with map marker requests.
High-level approaches to identifying similar issues include:
- Use static analysis to flag SQL statements built through string concatenation or interpolation with request-derived values.
- Review endpoint handlers and database access code for unparameterized inputs and missing server-side type checks.
- Enforce code-review and CI policies requiring parameterized database queries.
- Monitor database errors, unusual query patterns, and unexpected resource consumption associated with map marker requests.
