m4k4br0.github.io
https://m4k4br0.github.io/sugarcrm-xss CVE-2018-5715
MEDIUMNuclei
SugarCRM 3.5.1 - Cross-Site Scripting
Record summary
CVE-2018-5715 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit and 1 Nuclei template.
Proofs of concept
1Catalogued exploits
ExploitDBSugarCRM 3.5.1 - Cross-Site ScriptingExploitDB exploitby Guilherme AssmannNot analyzed1 file
Nuclei templates
1ProjectDiscoveryMEDIUMSugarCRM 3.5.1 - Cross-Site ScriptingCVSS 6.1
SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string (aka a $key variable).
Impact
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
Remediation
Upgrade to a patched version of SugarCRM or apply the necessary security patches provided by the vendor.
WeaknessesCWE-79
Authorsedoardottt
Template tagscve2018cvesugarcrmxssedbvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:sugarcrm:sugarcrm:3.5.1:*:*:*:*:*:*:*
Shodan: http.html:"SugarCRM Inc. All Rights Reserved"
Shodan: http.title:sugarcrm
Shodan: http.html:"sugarcrm inc. all rights reserved"
FOFA: body="sugarcrm inc. all rights reserved"
FOFA: title=sugarcrm
Google: intext:"SugarCRM Inc. All Rights Reserved"
Google: intitle:sugarcrm
Google: intext:"sugarcrm inc. all rights reserved"
https://www.exploit-db.com/exploits/43683 https://m4k4br0.github.io/sugarcrm-xss/ https://www.exploit-db.com/exploits/43683/ https://nvd.nist.gov/vuln/detail/CVE-2018-5715 https://github.com/ARPSyndicate/kenzer-templates
Source: ProjectDiscovery
References
3nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-5715 43683exploit
https://www.exploit-db.com/exploits/43683