CVE-2023-22952highunder attackCWE-94

CVE-2023-22952

Published · Updated

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 80%
from disclosure to weaponsame day
Published on NVDJan 11
metasploitDec 28
CISA KEV+22d
Action required by CISAfederal deadline: 2023-02-23

Apply updates per vendor instructions.

In short

SugarCRM versions before 12.0 Hotfix 91155 allow attackers to inject and execute malicious PHP code through email templates due to insufficient input validation. This can lead to complete system compromise and unauthorized access to sensitive data.

Technical detail

A remote attacker can exploit CWE-94 (Improper Control of Generation of Code) by crafting requests that inject arbitrary PHP code into EmailTemplates without proper input validation. The vulnerability allows code execution in the context of the application, potentially leading to complete server compromise and data breach.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.