EIP-2026-112473

The writeup describes two PHP code injection vulnerabilities in SugarCRM <= 6.5.18. The first involves improper escaping in the 'override_value_to_string_recursive2' function, allowing arbitrary PHP code execution via crafted input. The second allows authenticated administrators to upload and execute arbitrary PHP code through the Upgrade Wizard module.