PT-2017-16399 · Sage · Sagecrm

Published 2017-02-02 · Updated 2017-03-02 · CVE-2017-5218

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SageCRM versions 7.x through 7.3 SP2

Description A SQL Injection issue was discovered. The AP DocumentUI.asp web resource includes Utilityfuncs.js, which crafts a SQL statement to identify the database in use with the current user's session. The database variable can be populated from the URL and manipulated to obtain access to the underlying database using non-expected characters. A Proof of Concept URI is /CRM/CustomPages/ACCPAC/AP DocumentUI.asp?SID=&database=1';WAITFOR DELAY '0:0:5'--

Recommendations For SageCRM versions 7.x through 7.3 SP2, update to version 7.3 SP3 or later to resolve the issue. As a temporary workaround, consider restricting access to the AP DocumentUI.asp web resource and the Utilityfuncs.js file to minimize the risk of exploitation. Avoid using the database variable in the affected API endpoint until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-5218

Affected Products

Sagecrm

References · 4

• https://osv.dev/vulnerability/CVE-2017-5218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5218 · Security Note
• http://research.aurainfosec.io/disclosures/sagecrm-CVE-2017-5219-CVE-2017-5218 · Note
• http://securityfocus.com/bid/95968 · Note