High · published January 11, 2023
CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.6th percentile for exploit probability.
🚨 A crafted request is all it takes to inject PHP code in SugarCRM versions before 12.0 Hotfix 91155! 🔥 Think of it like a restaurant allowing customers to submit their own recipes without checking for allergens — a sneaky way to introduce something dangerous into the mix! If exploited, an attacker could execute arbitrary PHP code, leading to unauthorized access or complete control over the CRM system. This could put sensitive data at risk and disrupt business operations in an absolutely devastating way.
Think of it like a restaurant allowing customers to submit their own recipes without checking for allergens — a sneaky way to introduce something dangerous into the mix! This vulnerability arises from inadequate input validation in the EmailTemplates feature of SugarCRM, allowing attackers to craft requests that insert malicious PHP code into the system.
If exploited, an attacker could execute arbitrary PHP code, leading to unauthorized access or complete control over the CRM system. This could put sensitive data at risk and disrupt business operations in an absolutely devastating way. Immediately update SugarCRM to version 12.0 Hotfix 91155 or later to close this security gap. Additionally, review and validate all input in your email templates to prevent future exploits. You've got this! By taking these steps, you'll bolster your defenses and keep your data safe. 🛡️