Test ID:	1.3.6.1.4.1.25623.1.0.106123
Category:	Web application abuses
Title:	SugarCRM Multiple Vulnerabilities
Summary:	SugarCRM is prone to multiple vulnerabilities.
Description:	Summary: SugarCRM is prone to multiple vulnerabilities. Vulnerability Insight: SugarCRM is prone to multiple vulnerabilities: The application fails to properly check whether the user has administrator privileges within the following scripts: /modules/Administration/ImportCustomFieldStructure.php, /modules/Administration/UpgradeWizard_commit.php, /modules/Connectors/controller.php ('RunTest' action) The 'override_value_to_string_recursive2()' function is being used to save an array into a configuration file with a .php extension. However, this function does not properly escape key names, and this can be exploited to inject and execute arbitrary PHP code. User input passed through the 'type_module' request parameter isn't properly sanitized before being used to instantiate a new DashletRssFeedTitle object, and this could be exploited to carry out certain attacks because of the DashletRssFeedTitle::readFeed() method (user input passed directly to the 'fopen()' function). Vulnerability Impact: An authenticated attacker may execute arbitrary OS commands. Affected Software/OS: Version <= 6.5.18 Solution: Update to 6.5.19 or newer. CVSS Score: 5.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.