Exploitation Summary
EIP tracks 1 public exploit for EIP-2026-112473. PoCs published by Egidio Romano.
AI-analyzed exploit summary The writeup describes two PHP code injection vulnerabilities in SugarCRM <= 6.5.18. The first involves improper escaping in the 'override_value_to_string_recursive2' function, allowing arbitrary PHP code execution via crafted input. The second allows authenticated administrators to upload and execute arbitrary PHP code through the Upgrade Wizard module.
Description
SugarCRM 6.5.18 - PHP Code Injection
Exploits (1)
The writeup describes two PHP code injection vulnerabilities in SugarCRM <= 6.5.18. The first involves improper escaping in the 'override_value_to_string_recursive2' function, allowing arbitrary PHP code execution via crafted input. The second allows authenticated administrators to upload and execute arbitrary PHP code through the Upgrade Wizard module.