CVE-2012-0694

CRITICAL

SugarCRM CE <= 6.3.1 - Code Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2012-0694. PoCs published by Metasploit, EgiX, EgiX, juan vazquez, sinn3r, including Metasploit module exploits/unix/webapp/sugarcrm_unserialize_exec.

AI-analyzed exploit summary This Metasploit module exploits a PHP unserialize() vulnerability in SugarCRM <= 6.3.1, allowing authenticated users to execute arbitrary code via the '__destruct()' method of the 'SugarTheme' class. It writes a malicious PHP file to the web root and triggers payload execution via a crafted HTTP request.

Description

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappsphp
https://www.exploit-db.com/exploits/19403

This Metasploit module exploits a PHP unserialize() vulnerability in SugarCRM <= 6.3.1, allowing authenticated users to execute arbitrary code via the '__destruct()' method of the 'SugarTheme' class. It writes a malicious PHP file to the web root and triggers payload execution via a crafted HTTP request.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SugarCRM <= 6.3.1
Auth required
Prerequisites: Valid SugarCRM credentials · Access to the SugarCRM web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by EgiX · phpwebappsphp
https://www.exploit-db.com/exploits/19381

This exploit leverages a PHP object injection vulnerability in SugarCRM CE <= 6.3.1 via insecure unserialize() usage. It authenticates, crafts a malicious serialized SugarTheme object, and achieves remote code execution by writing a web shell to pathCache.php.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SugarCRM CE <= 6.3.1
Auth required
Prerequisites: valid SugarCRM credentials · network access to target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by EgiX, juan vazquez, sinn3r · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb

This Metasploit module exploits a PHP unserialize vulnerability in SugarCRM <= 6.3.1, allowing authenticated users to execute arbitrary code via the __destruct method of the SugarTheme class. It writes a malicious PHP file to the web root and triggers execution via a crafted HTTP request.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: SugarCRM <= 6.3.1
Auth required
Prerequisites: Valid SugarCRM credentials · Access to the SugarCRM web interface
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2012-0694
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/19381
Mailing List, Third Party Advisory x_refsource_misc
https://seclists.org/bugtraq/2012/Jun/165

Scores

CVSS v3 9.8
EPSS 0.8379
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (1)
sugarcrm/sugarcrm < 6.3.1
Published Oct 29, 2019
Tracked Since Feb 18, 2026