PT-2019-15062

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Administration module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 ...

PT-2019-15074

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows directory traversal in the attachment function by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 ...

PT-2019-15068

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...

PT-2019-15055

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the pmse Inbox module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

PT-2019-15080 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description: The issue allows PHP object injection in the UpgradeWizard module by an Admin user. Recommendations: For SugarCRM versions prior to 8.0.4, update to version...

SugarCRM Enterprise Cross-Site Scripting Vulnerability

SugarCRM Enterprise is an enterprise version of an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and information sharing and tracking of sales...

CVE-2019-14974

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS...

CVE-2019-14974

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS...

Cross site scripting

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS...

CVE-2019-14974

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS...

CVE-2019-14974

CVE-2019-14974 : SugarCRM Enterprise 9.0.0 has a cross-site scripting (XSS) vulnerability exploitable via the path mobile/error-not-supported-platform.html?desktop_url. The Nuclei template confirms the issue and describes impact as arbitrary JavaScript execution in the victim’s browser, enabling ...

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise Google Dork: N/A Date: 11.08.2019 Exploit Author: Ilca Lucian Florin Vendor Homepage: https://www.sugarcrm.com Version: 9.0.0 Tested on: Windows 7 / Internet Explorer 11 / Google Chrome 76...

PT-2019-13904

Name of the Vulnerable Software and Affected Versions SugarCRM Enterprise version 9.0.0 Description The issue allows for a cross-site scripting XSS attack. XSS is a type of attack where an attacker can inject malicious scripts into a website, potentially allowing them to steal user data or take...

CVE-2019-14974: Improper Neutralization of Input During Web Page Generation

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS...

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting

Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise Google Dork: N/A Date: 11.08.2019 Exploit Author: Ilca Lucian Florin Vendor Homepage: https://www.sugarcrm.com Version: 9.0.0 Tested on: Windows 7 / Internet Explorer 11 / Google Chrome 76 CVE : 2019-14974 The application fails to sanitiz...

Defining Wallarm API-specific Rules

Case Study Using SugarCRM API As an Example A unique Wallarm AI feature is its ability to automatically detect and parse complicated API protocols and then set up security rules based on specific data or parameters deep inside the API. Once parsed, the system creates the rules-based both on where...

SugarCRM (Web Logic Hooks module) Path Traversal Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A path traversal...

SugarCRM WorkFlow PHP Code Injection Vulnerability

SugarCRM versions prior to 7.9.4.0 and 7.11.0.0 suffer from a PHP code injection vulnerability in the WorkFlow module. User input passed through the $POST'basemodule' parameter to the "Save" action of the WorkFlow module is not properly sanitized before being used to write data into the...

SugarCRM (Web Logic Hooks module) PHP Code Injection Vulnerability

SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and enables information sharing and tracking of sales representatives. A PHP code...

SugarCRM Web Logic Hooks Module Path Traversal Vulnerability

SugarCRM versions prior to 7.9.5.0, 8.0.2, and 8.2.0 suffer from a path traversal vulnerability. User input passed through the "webhooktargetmodule" parameter is not properly sanitized before being used to save PHP code into the hooks file through the Web Logic Hooks module. This can be exploited...