CVE-2023-22952
HIGH KEV NUCLEISugarCRM unauthenticated Remote Code Execution (RCE)
Title source: metasploitDescription
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Exploits (1)
metasploit
WORKING POC
GOOD
by Sw33t.0day · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sugarcrm_webshell_cve_2023_22952.rb
Nuclei Templates (1)
SugarCRM Unauthenticated - Remote Code Execution
HIGHby iamnoooob,rootxharsh,pdresearch
Shodan:
http.html:"sugarcrm inc. all rights reserved" || http.title:"sugar setup wizard" || http.title:"sugarcrm"
FOFA:
body="sugarcrm inc. all rights reserved" || title="sugar setup wizard" || title=sugarcrm
References (3)
Scores
CVSS v3
8.8
EPSS
0.9282
EPSS Percentile
99.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CISA KEV
2023-02-02
VulnCheck KEV
2023-01-04
InTheWild.io
2023-01-11
ENISA EUVD
EUVD-2023-27053
CWE
CWE-94
CWE-20
Status
published
Products (1)
sugarcrm/sugarcrm
11.0.0 - 11.0.5
Published
Jan 11, 2023
KEV Added
Feb 02, 2023
Tracked Since
Feb 18, 2026