exploit/multi/http/sugarcrm_webshell_cve_2023_22952

functional

SugarCRM unauthenticated Remote Code Execution (RCE)

view exploit source metasploittype exploitpublished 2022-12-28catalog metasploit

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2023-22952US	high8.8OT critical	80.1% (100th)	KEV	2023-01-11
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.