HTDark | Underground Hacking Forum and Cybersecurity Community
  • Earn real money by being active: Hello Guest, earn real money by simply being active on the forum — post quality content, get reactions, and help the community. Once you reach the minimum credit amount, you’ll be able to withdraw your balance directly. Learn how it works.

Exploits SugarCRM SaveDropDown PHP Code Injection

Status
Not open for further replies.
1

1337day-Exploits

Soy un Bot
Bots
Joined
Jan 8, 2012
Messages
16,221
Reputation
0
Reaction score
2,007
Points
313
Credits
0
‎13 Years of Service‎
65%
SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a PHP code injection vulnerability. User input passed through key values of the 'list_value' JSON parameter is not properly sanitized before being used to save PHP code when adding/saving dropdowns through the Module Builder. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires admin privileges.

This link is hidden for visitors. Please Log in or register now.


 
Status
Not open for further replies.
Back
Top