PT-2019-6725 · Sugarcrm · Sugarcrm Ce

Egidio Romano + 1 · Publicado 2019-10-29 · Atualizado 2019-11-01 · CVE-2012-0694

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SugarCRM CE versions 6.3.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code due to the use of unserialize() with user-controlled input in certain scripts.

Recommendations For SugarCRM CE versions 6.3.1 and earlier, as a temporary workaround, consider restricting access to the affected scripts that utilize unserialize() with user-controlled input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-0694

Produtos afetados

Sugarcrm Ce

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19403 · Exploit
• 🔥 https://exploit-db.com/exploits/19381 · Exploit
• https://t.me/cibsecurity/7754 · Publicação no Telegram
• https://seclists.org/bugtraq/2012/Jun/165 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0694 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-0694 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-0694 · Aviso do Fabricante