Test ID:	1.3.6.1.4.1.25623.1.0.20286
Category:	Web application abuses
Title:	SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability
Summary:	The version of SugarCRM installed on the remote host does not; properly sanitize user input in the 'beanFiles[]' parameter in the 'acceptDecline.php' file.
Description:	Summary: The version of SugarCRM installed on the remote host does not properly sanitize user input in the 'beanFiles[]' parameter in the 'acceptDecline.php' file. Vulnerability Impact: A attacker can use this flaw to display sensitive information and to include malicious code which can be used to execute arbitrary commands. This vulnerability exists if 'register_globals' is enabled. Solution: Update to ver 3.5.1e and/or disable PHP's 'register_globals' setting. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2005-4087 BugTraq ID: 15760 http://www.securityfocus.com/bid/15760 Bugtraq: 20051207 SugarSuite Open Source <= 4.0beta Remote code execution (Google Search) http://www.securityfocus.com/archive/1/418840 http://securityreason.com/securityalert/239 XForce ISS Database: sugarsuite-acceptdecline-file-include(23541) https://exchange.xforce.ibmcloud.com/vulnerabilities/23541 Common Vulnerability Exposure (CVE) ID: CVE-2005-4086 http://rgod.altervista.org/sugar_suite_40beta.html http://securitytracker.com/id?1015322 http://secunia.com/advisories/17948 http://www.vupen.com/english/advisories/2005/2800
Copyright	Copyright (C) 2005 Ferdy Riphagen

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.