CyberSec.Space Logo
返回 CVE 浏览器

CVE-2023-46816

HIGH
8.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2023-10-27
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

Affected Platforms (CPE)

📦
Sugarcrm

Sugarcrm

>= 12.0.0 and < 12.0.4= 13.0.0= 13.0.1

References & Advisories

🔗 https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/
🔗 https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/

相关漏洞威胁

CVE-2025-133614.3

The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1....

CVE-2024-582587.2

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

CVE-2025-250349.3

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to imp...

CVE-2023-468158.8

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been iden...