Description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

Related CPE's

a

sugarcrm

sugarcrm

2

References

http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html

ExploitThird Party AdvisoryVDB Entry

https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/

Vendor Advisory

http://packetstormsecurity.com/files/171320/SugarCRM-12.x-Remote-Code-Execution-Shell-Upload.html

ExploitThird Party AdvisoryVDB Entry

https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2023-001/

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22952

US Government Resource

Weaknesses

[email protected]

Primary
CWE-20

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-94

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 · High

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2023-01-11T08:15:08.787Z

3 years ago

Last modified

2025-11-03T17:50:19.817Z

4 months ago