1306 matches found
SuiteCRM Unauthenticated Graphql Introspection
Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...
SuiteCRM - SQL Injection
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. id: CVE-2024-36412 info: name: SuiteC...
SuiteCRM-RCE
CVE-2020-28328 SuiteCRM ログファイルシステム設定とログファイルポイズニングによるリモートコード実行 概要 私は最近、SuiteCRM に2つの脆弱性を発見しました。これにより、低権限ユーザーが基盤となるオペレーティングシステム上でコード実行を達成する攻撃チェーンが可能になります。攻撃チェーンはクロスサイトスクリプティングで、これを利用してクロスサイトリクエストフォージェリを実行し、アプリケーション設定を改ざんしてログファイルをポイズニングすることでリモートコード実行に至ります。これはすべて、悪意のある JavaScript...
CVE-2022-23940
CVE-2022-23940 CVE-2022-23940 の PoC（別名 SCRMBT-187 ） - SuiteCRM（= 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2022-23940...
CVE-2021-45897
CVE-2021-45897 CVE-2021-45897（別名SCRMBT-180）のPoC - SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45897...
CVE-2021-45041
CVE-2021-45041 CVE-2021-45041 の PoC、別名 SCRMBT-177 - SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45041 使用例: root@kitploit: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host http://localhost --username user --password...
CVE-2024-36416
CVE-2024-36416 CVE-2024-36416 を検証するためのツール 使用方法 root@kitploit: pip3 install -r requirements.txt python3 sukuna.py --help python3 sukuna.py --url http://./ --validate --payload-test サーバーサイドのログファイル確認 サーバーサイドのファイルを確認してください。ログファイル \service\example\proxy.log が 25MB 以上の場合、サーバーは脆弱である可能性が高いです。 既知の問題 zip...
CVE-2024-50335
CVE-2024-50335: 「Publish Key」フィールドにおける認証済みXSSにより、不正な管理者ユーザーの作成が可能 概要 SuiteCRMのEdit Profileページにある「Publish Key」フィールドは、反射型クロスサイトスクリプティング XSS に対して脆弱であり、攻撃者が悪意のあるJavaScriptコードを注入できる可能性があります。これを悪用すると、CSRFトークンを窃取し、適切な認証なしに新しい管理者ユーザーを作成するなどの不正な操作を実行できます。 詳細 この脆弱性は、SuiteCRMアプリケーション内のPublish...
VulnCheck KEV: CVE-2024-36412
SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
EUVD-2019-20062
SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection...
EUVD-2019-20064
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25663
SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection...
CVE-2019-25663
SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection...
CVE-2019-25664
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25664
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25664 SuiteCRM 7.10.7 SQL Injection via record Parameter
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25664
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25664
CVE-2019-25664 affects SuiteCRM 7.10.7. A time-based SQL injection exists in the Records parameter of the Users module DetailView, enabling authenticated attackers to influence database queries by appending SQL to the record parameter in GET requests to index.php. This can be used to extract sens...
CVE-2019-25664 SuiteCRM 7.10.7 SQL Injection via record Parameter
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to...
CVE-2019-25663 SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection...