CVE-2012-0694 SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
CriticalCVSS 9.8
EPSS 67.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sugarcrm | <= 6.3.1 | No fix listed |
References
- security-tracker.debian.org third-party-advisory
- 19381 exploit third-party-advisory vdb-entry
- seclists.org mailing-list third-party-advisory