CVE-2023-22952

HIGH KEV NUCLEI

SugarCRM unauthenticated Remote Code Execution (RCE)

Title source: metasploit

Description

In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

Exploits (1)

metasploit WORKING POC GOOD
by Sw33t.0day · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sugarcrm_webshell_cve_2023_22952.rb

Nuclei Templates (1)

SugarCRM Unauthenticated - Remote Code Execution
HIGHby iamnoooob,rootxharsh,pdresearch
Shodan: http.html:"sugarcrm inc. all rights reserved" || http.title:"sugar setup wizard" || http.title:"sugarcrm"
FOFA: body="sugarcrm inc. all rights reserved" || title="sugar setup wizard" || title=sugarcrm

Scores

CVSS v3 8.8
EPSS 0.9282
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CISA KEV 2023-02-02
VulnCheck KEV 2023-01-04
InTheWild.io 2023-01-11
ENISA EUVD EUVD-2023-27053
CWE
CWE-94 CWE-20
Status published
Products (1)
sugarcrm/sugarcrm 11.0.0 - 11.0.5
Published Jan 11, 2023
KEV Added Feb 02, 2023
Tracked Since Feb 18, 2026