PT-2023-8060 · Sugarcrm · Sugarcrm
Publicado
2023-01-11
·
Atualizado
2025-03-14
·
CVE-2023-22952
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
The issue at hand is related to SugarCRM, a customer relationship management platform, which has been found to be susceptible to a Remote Code Execution (RCE) exploit. This exploit can be triggered through the EmailTemplates feature due to a lack of proper input validation, allowing an attacker to inject custom PHP code.
The versions of SugarCRM that are affected by this issue are those prior to 12.0, specifically before the application of Hotfix 91155.
It's worth noting that there is a publicly available exploit for this issue, and instances of it being exploited in the wild have been documented.
For those looking for more detailed information, including a walkthrough of how this exploit works and its implications, there are resources available online, such as a detailed analysis and a follow-up post to a talk given at BlackHatEvents.
#SugarCRM #RCE #RemoteCodeExecution #PHP #Exploit #Cybersecurity #OSINT #Cyberspacemapping
Exploit
Correção
RCE
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Sugarcrm