Summary An authenticated SQL injection vulnerability exists in SuiteCRM's Project Template module. The action_get_end_date function accepts user-supplied POST parameters task_id and lag and interpolates them directly into a SQL query without sanitization, parameterization, or escaping. An authenticated attacker can exploit this to extract sensitive data from the database including user credentials, perform blind time-based enumeration of the entire database, and potentially escalate to further compromise depending on database user privileges. Impact Who is impacted: Any SuiteCRM deployment where an attacker has obtained a valid user account of any privilege level. No administrative rights are required to reach this endpoint. Business impact: Full contents of the CRM database are accessible to any authenticated user, including all customer data, internal communications, and administrator credentials. Successful exploitation of extracted admin hashes would result in complete application takeover.