PT-2023-8060 · Sugarcrm · Sugarcrm
Published
2023-01-11
·
Updated
2025-03-14
·
CVE-2023-22952
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
The issue at hand is related to SugarCRM, a customer relationship management platform, which has been found to be susceptible to a Remote Code Execution (RCE) exploit. This exploit can be triggered through the EmailTemplates feature due to a lack of proper input validation, allowing an attacker to inject custom PHP code.
The versions of SugarCRM that are affected by this issue are those prior to 12.0, specifically before the application of Hotfix 91155.
It's worth noting that there is a publicly available exploit for this issue, and instances of it being exploited in the wild have been documented.
For those looking for more detailed information, including a walkthrough of how this exploit works and its implications, there are resources available online, such as a detailed analysis and a follow-up post to a talk given at BlackHatEvents.
#SugarCRM #RCE #RemoteCodeExecution #PHP #Exploit #Cybersecurity #OSINT #Cyberspacemapping
Exploit
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sugarcrm