CVE-2019-17317

SugarCRM vulnerability CVE-2019-17317 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, where an Admin can trigger PHP object injection via the UpgradeWizard module. The root cause is input handling in UpgradeWizard that allows object injection, enabling impact as described in affected advisori...

CVE-2019-17317: Improperly Controlled Modification of Object Prototype Attributes

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

SugarCRM 6.5.18 - PHP Code Injection

SugarCRM 6.5.18 - PHP Code Injection --------------------------------------------------------- SugarCRM $val 104. $str.= overridevaluetostringrecursive2$newArrayName, $key, $val, $saveempty; 105. 106. return $str; 107. else 108. if!$saveempty && empty$value 109. return; 110. else 111. return...

SugarCRM 6.5.18 PHP Code Injection

--------------------------------------------------------- SugarCRM $val 104. $str.= overridevaluetostringrecursive2$newArrayName, $key, $val, $saveempty; 105. 106. return $str; 107. else 108. if!$saveempty && empty$value 109. return; 110. else 111. return "$$arrayname" . "'$valuename' = "...