Author:
Janek Vind 'waraxe'
Vulnerable:
SugarCRM SugarCRM 5.5.0.RC2
SugarCRM SugarCRM 5.2.0j
Product:
http://www.sugarcrm.com/crm/
Description:
SugarCRM is prone to multiple remote vulnerabilities, including:
1. Multiple SQL-injection vulnerabilities
2. Multiple unauthorized access vulnerabilities
3. A remote file-include vulnerability
4. A remote code-execution vulnerability
Exploiting these issues could allow an attacker to gain unauthorized access to the affected application, gain access to sensitive information, execute arbitrary PHP code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.
SugarCRM 5.2.0j and 5.5.0.RC2 are vulnerable; other versions may also be affected.
POC:
An attacker can exploit these issues through a browser
The following example URIs are available:
http://server/sugarce520j/index.php?module=Opportunities&action=index
Opportunities2_OPPORTUNITY_offset
http://server/sugarce520j/index.php?module=Project&action=index
Project2_PROJECT_offset
http://server/sugarce520j/index.php?module=Cases&action=index
Cases2_CASE_offset
http://server/sugarce520j/index.php?module=Bugs&action=index
Bugs2_BUG_offset
http://server/sugarce520j/index.php?module=Tasks
Tasks2_TASK_offset
http://server/sugarce520j/index.php?module=Meetings&action=index&return_module=Meetings&return_action=DetailView
Meetings2_MEETING_offset
http://server/sugarce520j/index.php?module=Calls&action=index&return_module=Calls&return_action=DetailView
Calls2_CALL_offset
http://server/sugarce520j/index.php?module=Notes&action=index&return_module=Notes&return_action=DetailView
Notes2_NOTE_offset
http://server/sugarce520j/index.php?entryPoint=HandleAjaxCall&method=remove&file=sugarcrm.log
