PT-2005-4818 · Sugarcrm · Sugarcrm

Published 2005-12-08 · Updated 2011-03-08 · CVE-2005-4086

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SugarCRM versions 4.0 beta and earlier

Description A directory traversal issue exists, allowing remote attackers to include arbitrary local files. This is achieved by using ".." sequences in the beanFiles array parameter in the acceptDecline.php file.

Recommendations For SugarCRM versions 4.0 beta and earlier, as a temporary workaround, consider restricting access to the acceptDecline.php file until a patch is available. Avoid using the beanFiles array parameter in the affected acceptDecline.php file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-4086

Affected Products

Sugarcrm

References · 10

• 🔥 https://exploit-db.com/exploits/1364 · Exploit
• 🔥 http://securityfocus.com/archive/1/418840 · Exploit
• 🔥 https://exploit-db.com/exploits/1359 · Exploit
• 🔥 http://securityfocus.com/bid/15760 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4086 · Security Note
• http://securitytracker.com/id?1015322 · Note
• http://rgod.altervista.org/sugar_suite_40beta.html · Note
• http://vupen.com/english/advisories/2005/2800 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4086 · Note
• http://secunia.com/advisories/17948 · Note