CVE-2006-2460

EPSS 10.0%

Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/1785unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://retrogod.altervista.org/sugar_suite_42_incl_xpl.html http://secunia.com/advisories/20072 http://securityreason.com/securityalert/921 http://securitytracker.com/id?1016087 https://exchange.xforce.ibmcloud.com/vulnerabilities/26451 https://www.exploit-db.com/exploits/1785 http://www.osvdb.org/25532 http://www.securityfocus.com/archive/1/434009/100/0/threaded http://www.securityfocus.com/bid/17987 http://www.vupen.com/english/advisories/2006/1791