vendor:
SugarCRM
by:
Janek Vind 'waraxe'
9
CVSS
HIGH
SQL-injection, unauthorized access, remote file-include, remote code-execution
89, 522, 538, 639, 798
CWE
Product Name: SugarCRM
Affected Version From: SugarCRM 5.2.0j
Affected Version To: SugarCRM 5.5.0.RC2
Patch Exists: YES
Related CWE: N/A
CPE: //a:sugarcrm:sugarcrm
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006
Multiple Remote Vulnerabilities in SugarCRM
SugarCRM is prone to multiple remote vulnerabilities, including multiple SQL-injection vulnerabilities, multiple unauthorized access vulnerabilities, a remote file-include vulnerability, and a remote code-execution vulnerability. Exploiting these issues could allow an attacker to gain unauthorized access to the affected application, gain access to sensitive information, execute arbitrary PHP code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible. An attacker can exploit these issues through a browser.
Mitigation:
Upgrade to the latest version of SugarCRM.
