CVE-2012-0694

Related Files

SugarCRM 6.3.1 unserialize() PHP Code Execution

Posted Jun 27, 2012

Authored by EgiX, sinn3r, juan vazquez | Site metasploit.com

This Metasploit module exploits a php unserialize() vulnerability in SugarCRM versions 6.3.1 and below which could be abused to allow authenticated SugarCRM users to execute arbitrary code with the permissions of the webserver. The dangerous unserialize() exists in the 'include/MVC/View/views/view.list.php' script, which is called with user controlled data from the 'current_query_by_page' parameter. The exploit abuses the __destruct() method from the SugarTheme class to write arbitrary PHP code to a 'pathCache.php' on the web root.

tags | exploit, web, arbitrary, root, php

advisories | CVE-2012-0694

SHA-256 | 1e73a4a4f9bf312d43feeea95213bce49f5dcf97660320b96cca53b8c0f4ba3d

Download | Favorite | View

SugarCRM CE 6.3.1 PHP Code Execution

Posted Jun 25, 2012

Authored by EgiX

SugarCRM CE versions 6.3.1 and below suffer from an unserialize() PHP code execution vulnerability.

tags | exploit, php, code execution

advisories | CVE-2012-0694

SHA-256 | aab5a6efe1a4cde61efe9db861472c86ce178987dbf7a7fa592b500fdf1a7a17

Download | Favorite | View