QwikSec

Security Database

CVE

CWE

Training

CVE-2011-4833

Published: Dec 15, 2011

Modified: Aug 7, 2024

PUBLISHED

Description

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

sugarcrm-index-sql-injection(71586)

vdb-entry

x_refsource_XF

http://www.sugarcrm.com/crm/support/bugs.html#issue_47839

x_refsource_CONFIRM

https://www.htbridge.ch/advisory/sql_injection_in_sugarcrm.html

x_refsource_MISC

vdb-entry

x_refsource_OSVDB

http://www.sugarcrm.com/crm/support/bugs.html#issue_47805

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_SECTRACK

http://www.sugarcrm.com/crm/support/bugs.html#issue_47806

x_refsource_CONFIRM

http://www.sugarcrm.com/crm/support/bugs.html#issue_47800

x_refsource_CONFIRM

20111130 Sql injection in SugarCRM

mailing-list

x_refsource_BUGTRAQ

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.