Multiple SugarCRM Products Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/02/2023. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| sugarcrm | ≥ 11.0.0, < 11.0.5≥ 12.0.0, < 12.0.2 | 11.0.512.0.2 |
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free