CVE-2023-46816

Published: Oct 27, 2023Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

Affected (9)

Products: Sugarcrm: Sugarcrm

Sugarcrm

1 product

Sugarcrm

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	From 12.0.0 to 12.0.4
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.0
Sugarcrm Sugarcrm	Version 13.0.1
Sugarcrm Sugarcrm	Version 13.0.1
Sugarcrm Sugarcrm	Version 13.0.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/

Source: cve@mitre.org

Vendor Advisory

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.