{"id": "CVE-2004-1228", "bulletinFamily": "NVD", "title": "CVE-2004-1228", "description": "The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default.", "published": "2005-01-10T05:00:00", "modified": "2017-07-11T01:30:00", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1228", "reporter": "cve@mitre.org", "references": ["https://exchange.xforce.ibmcloud.com/vulnerabilities/18449", "http://marc.info/?l=bugtraq&m=110295433323795&w=2"], "cvelist": ["CVE-2004-1228"], "type": "cve", "lastseen": "2019-05-29T18:08:03", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "84372a28d9c2bf11aed96c0be90a9e33"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cpe23", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvelist", "hash": "5b252afe1911d30bdffb3d2f961eea7e"}, {"key": "cvss", "hash": "9b257ef804cfe63c30c04ab15f4e91cd"}, {"key": "cvss2", "hash": "315d7a7b15cda393ce9fffb73645c6c3"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "24664563bcabc4d9b277c1c87b5509cb"}, {"key": "href", "hash": "f6ac087015db966f04718b56d640dc10"}, {"key": "modified", "hash": "d4139c3e94ad56ac445ba08d871e8a46"}, {"key": "published", "hash": "a4587ac8c6f017b1d54c2cde6cfc7046"}, {"key": "references", "hash": "4ca1e8497546b391c4c9a036671b4949"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "1c13e6ece6f869bc49e0407d60cd4e1c"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "6ce793aa6a63fcbbdbe0631889d07c1b10bcd324e29d085aa083aa414b7ddd14", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:12230"]}], "modified": "2019-05-29T18:08:03"}, "score": {"value": 5.4, "vector": "NONE", "modified": "2019-05-29T18:08:03"}, "vulnersScore": 5.4}, "objectVersion": "1.3", "cpe": [], "affectedSoftware": [{"name": "sugarcrm sugar_sales", "operator": "le", "version": "2.0.1c"}], "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": [], "cwe": ["NVD-CWE-Other"]}

{"osvdb": [{"lastseen": "2017-04-28T13:20:07", "bulletinFamily": "software", "description": "## Vulnerability Description\nSugarCRM contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to multiple modules not properly sanitizing user-supplied input. This may allow a remote attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Solution Description\nUpgrade to version 2.0.1c or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nSugarCRM contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to multiple modules not properly sanitizing user-supplied input. This may allow a remote attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script.\n## Manual Testing Notes\nhttp://[victim]/index.php?module=Opportunities&action=../../../../../../../../etc /passwd%00&advanced=true\n## References:\nVendor URL: http://www.sugarcrm.com/\nVendor Specific News/Changelog Entry: http://sourceforge.net/project/shownotes.php?release_id=285077\n[Secunia Advisory ID:13287](https://secuniaresearch.flexerasoftware.com/advisories/13287/)\n[Related OSVDB ID: 12228](https://vulners.com/osvdb/OSVDB:12228)\n[Related OSVDB ID: 12229](https://vulners.com/osvdb/OSVDB:12229)\n[Related OSVDB ID: 12120](https://vulners.com/osvdb/OSVDB:12120)\nOther Advisory URL: http://www.gulftech.org/?node=research&article_id=00053-120104\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-11/0835.html\nISS X-Force ID: 18326\n[CVE-2004-1227](https://vulners.com/cve/CVE-2004-1227)\n[CVE-2004-1228](https://vulners.com/cve/CVE-2004-1228)\nBugtraq ID: 11740\n", "modified": "2004-12-01T06:51:16", "published": "2004-12-01T06:51:16", "href": "https://vulners.com/osvdb/OSVDB:12230", "id": "OSVDB:12230", "type": "osvdb", "title": "SugarCRM Multiple Module Traversal Arbitrary File Access", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}