SugarCRM 6.5.18 Missing Authorization

2016.06.24
Credit: Egidio Romano
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

-------------------------------------------------------------- SugarCRM <= 6.5.18 Missing Authorization Check Vulnerabilities -------------------------------------------------------------- [-] Software Link: http://www.sugarcrm.com/ [-] Affected Versions: Version 6.5.18 CE and prior versions. [-] Vulnerabilities Description: The application fails to properly check whether the user has administrator privileges within the following scripts: 1) /modules/Administration/ImportCustomFieldStructure.php 2) /modules/Administration/UpgradeWizard_commit.php 3) /modules/Connectors/controller.php ("RunTest" action) This can be exploited by authenticated users to access certain otherwise restricted administrative features or exploit further vulnerabilities within the affected scripts (e.g. a SQL injection vulnerability located within the ImportCustomFieldStructure.php file). [-] Solution: Update to version 6.5.19 CE or higher. [-] Disclosure Timeline: [22/10/2014] - Vendor notified [15/12/2014] - Version 6.5.19 CE released: http://bit.do/sugar6519 [29/04/2015] - CVE number requested [23/06/2016] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a CVE identifier for these vulnerabilities. [-] Credits: Vulnerabilities discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2016-04

References:

http://karmainsecurity.com/KIS-2016-04


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top