A vulnerability was found in SugarCRM up to 12.0.3/13.0.1. It has been declared as problematic. Affected by this vulnerability is the function GecControl of the component Template Handler. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect integrity. The summary by CVE is:

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

The weakness was presented 10/27/2023. The advisory is shared at support.sugarcrm.com. This vulnerability is known as CVE-2023-46816 since 10/27/2023. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading to version 12.0.4 or 13.0.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• SugarCRM

Version

• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 13.0.0
• 13.0.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion