PT-2019-6725 · Sugarcrm · Sugarcrm Ce

Egidio Romano + 1 · Published 2019-10-29 · Updated 2019-11-01 · CVE-2012-0694

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SugarCRM CE versions 6.3.1 and earlier

Description The issue allows remote attackers to execute arbitrary PHP code due to the use of unserialize() with user-controlled input in certain scripts.

Recommendations For SugarCRM CE versions 6.3.1 and earlier, as a temporary workaround, consider restricting access to the affected scripts that utilize unserialize() with user-controlled input until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-0694

Affected Products

Sugarcrm Ce

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/19403 · Exploit
• 🔥 https://exploit-db.com/exploits/19381 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0694 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-0694 · Vendor Advisory
• https://t.me/cibsecurity/7754 · Telegram Post
• https://seclists.org/bugtraq/2012/Jun/165 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0694 · Note