Vulnerability record · CVE-2022-23940 · published 10 March 2022
CVE-2022-23940: SuiteCRM Scheduled Reports PHP deserialization RCE
SSalesagility · Suitecrm
SuiteCRM through 7.12.1 and 8.x through 8.0.1 deserializes the email_recipients property of Scheduled Reports, allowing PHP object injection. An authenticated user with access to the Scheduled Reports module can store a crafted payload that executes when the report is accessed.
Description
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with authenticated RCE, public exploit references and very high EPSS, though it requires an authenticated account with module access.
What it is
SuiteCRM through 7.12.1 and 8.x through 8.0.1 deserializes the email_recipients property of Scheduled Reports, allowing PHP object injection. An authenticated user with access to the Scheduled Reports module can store a crafted payload that executes when the report is accessed.
Impact
An attacker gains remote code execution on the SuiteCRM server, leading to full compromise of confidentiality, integrity and availability of the application and its data.
Attack surface
Reached over the network through the Scheduled Reports module; the attacker must be authenticated with access to that module, and the payload executes when a report is viewed, so some victim interaction is implied.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.53235, 98.9th percentile) and references are tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade SuiteCRM to a release after 7.12.1 or 8.0.1 that fixes the deserialization issue.
- Restrict Scheduled Reports module access to the minimum set of trusted users.
- Audit existing scheduled reports for unexpected or malformed email_recipients values and remove suspicious ones.
- Apply WAF or input filtering rules that block serialized PHP object payloads in report fields.
Detection
- Search SuiteCRM database and logs for serialized PHP object strings (e.g., O: or C: patterns) in email_recipients fields.
- Monitor for unexpected outbound connections or process execution from the web server hosting SuiteCRM.
- Alert on creation or modification of Scheduled Reports by unusual or low-privilege accounts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://docs.suitecrm.com/8.x/admin/releases/8.0/ | Release NotesVendor Advisory |
| https://github.com/manuelz120 | ExploitThird Party Advisory |
| https://docs.suitecrm.com/8.x/admin/releases/8.0/ | Release NotesVendor Advisory |
| https://github.com/manuelz120 | ExploitThird Party Advisory |
Track CVE-2022-23940 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-23940), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
