CVE-2022-45185

HIGH

SuiteCRM 7.12.7 - Authenticated Remote Code Execution via Deserialization

Title source: llm

Description

An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve code execution.

References (3)

Core 3

Core References

Release Notes

https://docs.suitecrm.com/admin/releases/7.12.x/

Exploit, Third Party Advisory

https://github.com/Orange-Cyberdefense/CVE-repository/

View Exploit ZIP pw:eip

Exploit

https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/poc_SuiteCRM.py

View Exploit ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0112

EPSS Percentile 61.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-502

Status published

Products (1)

salesagility/suitecrm 7.12.7

Published Jan 07, 2025

Tracked Since Feb 18, 2026