----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
SugarCRM Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA37464

VERIFY ADVISORY:
http://secunia.com/advisories/37464/

DESCRIPTION:
Janek Vind has reported some vulnerabilities in SugarCRM, which can
be exploited by malicious users to conduct SQL injection attacks,
bypass certain security restrictions, and compromise a vulnerable
system.

1) Input passed via the "current_query_by_page" parameter to multiple
scripts is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Examples:
http://[host]/index.php?module=Project&action=index&Project2_PROJECT_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Opportunities&action=index&Opportunities2_OPPORTUNITY_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Project&action=index&Project2_PROJECT_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Cases&action=index&Cases2_CASE_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Bugs&action=index&Bugs2_BUG_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Tasks&Tasks2_TASK_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Meetings&action=index&return_module=Meetings&return_action=DetailView&Meetings2_MEETING_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Calls&action=index&return_module=Calls&return_action=DetailView&Calls2_CALL_offset=1&current_query_by_page=[code]
http://[host]/index.php?module=Notes&action=index&return_module=Notes&return_action=DetailView&Notes2_NOTE_offset=1&current_query_by_page=[code]

2) The application does not properly restrict access to the delete
functionality, which can be exploited to delete arbitrary files from
the webroot of the application.

3) Input passed via the "file" parameter to index.php (when
"entryPoint" is set to "HandleAjaxCall" and "method" is set to
"performInstall") is not properly sanitised before being used to
include files. This can be exploited to include arbitrary files from
local and remote resources.

4) The application does not properly restrict access to the Backup
functionality, which can be exploited to create and download backup
files.

5) The application does not properly restrict access to the "Upgrade
Wizard" functionality, which can be exploited to execute arbitrary
PHP code by uploading a PHP file compressed in ZIP format.

6) An error in the .htaccess file when SugarCRM is installed on the
Windows platform can be exploited to access files directly via
uppercase characters.

The vulnerabilities are reported in versions 5.2.0j and 5.5.0.RC2.
Other versions may also be affected

SOLUTION:
Update to version 5.2.0k.

The vulnerabilities are also addressed in version 5.5.0.RC4.

PROVIDED AND/OR DISCOVERED BY:
Janek Vind

ORIGINAL ADVISORY:
http://www.waraxe.us/advisory-76.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------