medium5.0Public exploit code
CVE-2005-4086
Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remot…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SugarSuite Open Source 4.0beta - Remote Code Execution (2)2005-12-08 · webapps · php · Verified
- SugarSuite Open Source 4.0beta - Remote Code Execution (1)2005-12-07 · webapps · php · Verified
Impact
Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sugarcrm | Sugar Suite | Versions 3.5, 4.0_beta |
References
- NVD record
- CVE.org record
- http://rgod.altervista.org/sugar_suite_40beta.html
- http://secunia.com/advisories/17948
- http://securitytracker.com/id?1015322
- http://www.securityfocus.com/archive/1/418840
- http://www.securityfocus.com/bid/15760
- http://www.vupen.com/english/advisories/2005/2800
- http://rgod.altervista.org/sugar_suite_40beta.html
- http://secunia.com/advisories/17948
- http://securitytracker.com/id?1015322
- http://www.securityfocus.com/archive/1/418840
- http://www.securityfocus.com/bid/15760
- http://www.vupen.com/english/advisories/2005/2800