CVE-2023-22952 Multiple SugarCRM Products Remote Code Execution
Attackers can inject custom PHP code via crafted requests in SugarCRM EmailTemplates due to missing input validation, leading to remote code execution.
- Exploited in the wild
- Since 2 Feb 2023
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22952?
CVE-2023-22952 is a high-severity code injection vulnerability in Sugarcrm Sugarcrm, published on 11 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Which versions are affected by CVE-2023-22952?
It affects 1 product.
Products include Sugarcrm Sugarcrm.
How do I fix CVE-2023-22952?
No fix has been published for CVE-2023-22952 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Feb 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-22952 being exploited?
Yes. Attackers have exploited CVE-2023-22952 in the wild since at least 2 Feb 2023.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in Sugarcrm Sugarcrm
Sources
Also known as GHSA-g9w6-c3gx-pmr3.