CVE-2020-28328

This exploit leverages an authenticated RCE vulnerability in SuiteCRM 7.11.15 and below by manipulating log file settings and poisoning logs with PHP code via the 'last_name' field. It requires admin credentials and executes arbitrary commands by triggering the malicious log file.

This is a detailed writeup describing an exploit chain for CVE-2020-28328 in SuiteCRM, involving XSS, CSRF, and RCE via log file poisoning. The attack requires a low-privileged user to trick an admin into executing malicious JavaScript, leading to remote code execution.

This Metasploit module exploits CVE-2020-28320 in SuiteCRM by manipulating log file extensions to achieve remote code execution. It leverages improper input validation to treat a log file as a PHP file, then injects malicious PHP code via user profile updates.