CVE-2020-28328
HIGHSuiteCRM < 7.11.17 - Remote Code Execution via Log File Name Setting
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2020-28328.
PoCs published by M. Cory Billington, mcorybillington, including Metasploit module exploits/linux/http/suitecrm_log_file_rce.
AI-analyzed exploit summary This exploit leverages an authenticated RCE vulnerability in SuiteCRM 7.11.15 and below by manipulating log file settings and poisoning logs with PHP code via the 'last_name' field. It requires admin credentials and executes arbitrary commands by triggering the malicious log file.
Description
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.
Exploits (3)
This exploit leverages an authenticated RCE vulnerability in SuiteCRM 7.11.15 and below by manipulating log file settings and poisoning logs with PHP code via the 'last_name' field. It requires admin credentials and executes arbitrary commands by triggering the malicious log file.
This is a detailed writeup describing an exploit chain for CVE-2020-28328 in SuiteCRM, involving XSS, CSRF, and RCE via log file poisoning. The attack requires a low-privileged user to trick an admin into executing malicious JavaScript, leading to remote code execution.
This Metasploit module exploits CVE-2020-28320 in SuiteCRM by manipulating log file extensions to achieve remote code execution. It leverages improper input validation to treat a log file as a PHP file, then injects malicious PHP code via user profile updates.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H