Sql injection in SugarCRM

Vulnerability ID: HTB23051 Reference: https://www.htbridge.ch/advisory/sqlinjectioninsugarcrm.html Product: SugarCRM Vendor: SugarCRM Inc. http://www.sugarcrm.com Vulnerable Version: Community Edition 6.3.0RC1 and probably prior Tested Version: Community Edition 6.3.0RC1 Vendor Notification: 05...

SugarCRM 6.3.0RC1 SQL Injection Vulnerability

No description provided by source. Vulnerable Version: Community Edition 6.3.0RC1 and probably prior Tested Version: Community Edition 6.3.0RC1 Vendor Notification: 05 October 2011 Vulnerability Type: SQL Injection Status: Fixed by Vendor Risk level: Medium Credit: High-Tech Bridge SA Security...

SugarCRM Community Edition 6.3.0RC1 SQL Injection

Vulnerability ID: HTB23051 Reference: https://www.htbridge.ch/advisory/sqlinjectioninsugarcrm.html Product: SugarCRM Vendor: SugarCRM Inc. http://www.sugarcrm.com Vulnerable Version: Community Edition 6.3.0RC1 and probably prior Tested Version: Community Edition 6.3.0RC1 Vendor Notification: 05...

SugarCRM Community Edition 6.3.0RC1 - index.php Multiple SQL Injections

SugarCRM Community Edition 6.3.0RC1 - index.php Multiple SQL Injections source: https://www.securityfocus.com/bid/50870/info SugarCRM Community Edition is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query...

SugarCRM Community Edition 6.3.0RC1 - 'index.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/50870/info SugarCRM Community Edition is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

SQL Injection in SugarCRM

High-Tech Bridge SA Security Research Lab has discovered vulnerability in SugarCRM, which can be exploited to perform SQL injection attacks. 1 SQL Injection Vulnerability in SugarCRM: CVE-2011-4833 Input passed via the "where" and "order" GET parameters to index.php is not properly sanitised befo...

CVE-2011-3803

SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layoututils.php and certain other files...

Information disclosure

SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layoututils.php and certain other files...

CVE-2011-3803

SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layoututils.php and certain other files...

CVE-2011-3803

CVE-2011-3803 affects SugarCRM 6.1.0. Remote attackers can read sensitive information by directly requesting certain PHP files (e.g., themes/Sugar5/layout_utils.php), triggering error messages that reveal the installation path. Root cause is information disclosure via error output when accessing ...

CVE-2011-0745

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...

CVE-2011-0745

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...

Design/Logic Flaw

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...

CVE-2011-0745

SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover 1 the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or 2 t...

CVE-2011-0745

SugarCRM prior to 6.1.3 is affected by CVE-2011-0745. The issue arises when reloading or directly requesting a warning page produced by a duplicate-check, allowing remote authenticated users to see names they normally should not access: (1) customer names via ShowDuplicates in the Accounts module...

SugarCRM 6.1.1 Privilege Restriction Bypass

Advisory: SugarCRM list privilege restriction bypass RedTeam Pentesting discovered a vulnerability in SugarCRM that allows logged in users to bypass restrictions of their list privilege, allowing to list all entries. Details ======= Product: SugarCRM Community Edition SugarCRM Professional SugarC...

SugarCRM 6.1.1 - Information Disclosure

SugarCRM 6.1.1 - Information Disclosure source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead...

SugarCRM 6.1.1 - Information Disclosure

source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks...

[RT-SA-2011-002] SugarCRM list privilege restriction bypass

Advisory: SugarCRM list privilege restriction bypass RedTeam Pentesting discovered a vulnerability in SugarCRM that allows logged in users to bypass restrictions of their list privilege, allowing to list all entries. Details ======= Product: SugarCRM Community Edition SugarCRM Professional SugarC...

SugarCRM Community Edition 5.5.2 Cross Site Request Forgery

!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...