PT-2006-3408 · Sugarcrm · Sugar Suite Open Source

Rgod · Published 2006-05-19 · Updated 2018-10-18 · CVE-2006-2460

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Sugar Suite Open Source (SugarCRM) versions 4.2 and earlier

Description The issue allows remote attackers to conduct attacks, such as directory traversal or PHP remote file inclusion, by modifying critical variables like $ GLOBALS and $ SESSION when register globals is enabled. This can be achieved by altering the GLOBALS[sugarEntry] parameter.

Recommendations For Sugar Suite Open Source (SugarCRM) versions 4.2 and earlier, disable the register globals setting to prevent modification of critical variables. As a temporary workaround, consider restricting access to sensitive parameters like GLOBALS[sugarEntry] until a more permanent solution is applied.

Exploit

Fix

Related Identifiers

CVE-2006-2460

Affected Products

Sugar Suite Open Source

References · 12

• 🔥 https://exploit-db.com/exploits/1785 · Exploit
• 🔥 http://securitytracker.com/id?1016087 · Exploit
• 🔥 http://retrogod.altervista.org/sugar_suite_42_incl_xpl.html · Exploit
• 🔥 http://securityfocus.com/bid/17987 · Exploit
• http://secunia.com/advisories/20072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2460 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2460 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26451 · Note
• http://securityreason.com/securityalert/921 · Note
• http://vupen.com/english/advisories/2006/1791 · Note
• http://osvdb.org/25532 · Note
• http://securityfocus.com/archive/1/434009/100/0/threaded · Note