vendor:
SuiteCRM
by:
M. Cory Billington
8.8
CVSS
HIGH
Remote Code Execution
94
CWE
Product Name: SuiteCRM
Affected Version From: 7.11.15
Affected Version To: 7.11.15
Patch Exists: YES
Related CWE: CVE-2020-28328
CPE: a:salesagility:suitecrm:7.11.15
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: Ubuntu 20.04 LTS
2020
SuiteCRM 7.11.15 – ‘last_name’ Remote Code Execution (Authenticated)
A vulnerability in SuiteCRM 7.11.15 and below allows an authenticated user to execute arbitrary code. This is due to the lack of input validation on the 'last_name' parameter when creating a new user. An attacker can craft a malicious payload and inject it into the 'last_name' parameter, which will be written to a log file in the web root. The attacker can then trigger the log file to execute the malicious payload.
Mitigation:
Input validation should be implemented on all user-supplied data.
