Vulnerability CVE-2021-42840
Published: 2021-10-22

Description:
SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.

Type:

CWE-434

 (Unrestricted Upload of File with Dangerous Type)

CVSS2 => (AV:N/AC:L/Au:S/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9/10
10/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Salesagility -> Suitecrm 

 References:
https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19
https://suitecrm.com/time-to-upgrade-suitecrm-7-11-19-7-10-30-lts-released/
https://theyhack.me/SuiteCRM-RCE-2/
Copyright 2024, cxsecurity.com

 

Back to Top