PT-2017-13494 · Sugarcrm · Sugar Community Edition+1

Published 2017-09-17 · Updated 2017-12-30 · CVE-2017-14508

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 7.7.2.3 SugarCRM versions 7.8.x prior to 7.8.2.2 SugarCRM versions 7.9.x prior to 7.9.2.0 Sugar Community Edition version 6.5.26

Description An issue was discovered in several areas of the Documents and Emails module that could allow an authenticated user to perform SQL injection. This can be demonstrated by a backslash character at the end of a bean id to "modules/Emails/DetailView.php". An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas, potentially allowing the attacker to modify the SQL database.

Recommendations For SugarCRM versions prior to 7.7.2.3, update to version 7.7.2.3 or later. For SugarCRM versions 7.8.x prior to 7.8.2.2, update to version 7.8.2.2 or later. For SugarCRM versions 7.9.x prior to 7.9.2.0, update to version 7.9.2.0 or later. For Sugar Community Edition version 6.5.26, update to a version that includes the fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-14508

Affected Products

Sugar Community Edition

Sugarcrm

References · 5

• 🔥 https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities · Exploit
• https://support.sugarcrm.com/Resources/Security/sugarcrm-sa-2017-006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14508 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14508 · Vendor Advisory
• https://synology.com/support/security/Synology_SA_17_53_SugarCRM · Note