SalesAgility SuiteCRM ‘export’ Request SQL Injection Vulnerability
2022-6-10 01:21:27 Author: blog.exodusintel.com(查看原文) 阅读量:35 收藏

EIP-0f5d2d7f

A SQL injection vulnerability exists within SalesAgility SuiteCRM within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-0f5d2d7f
  • MITRE CVE: Pending

Vulnerability Metrics

  • CVSSv2 Score: 9.7

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: March 2nd, 2022
  • Disclosed to public: June 9th, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.


文章来源: https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/?utm_source=rss&utm_medium=rss&utm_campaign=salesagility-suitecrm-export-request-sql-injection-vulnerability
如有侵权请联系:admin#unsafe.sh