CVE-2017-5218

High

Published: 02/02/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js, which crafts a SQL statement to identify the database in use with the current user's session, potentially allowing unauthorized access.

Risk Assessment

An attacker could exploit this vulnerability to gain access to sensitive data in the database, posing a serious security risk to the organization.

Recommendation

It is recommended to upgrade SageCRM to version 7.3 SP3 or later to mitigate this vulnerability and review the security of web applications.

Other vulnerabilities in SageCRM 7.x przed wersją 7.3 SP3

CVE-2017-5219Critical
An issue was discovered in SageCRM 7.x before 7.3 SP3 related to the Component Manager functionality, which allows additional components to be added to the application. It is possible to upload a zip file containing an .ecf file, leading to the extraction of files onto the filesystem, including a malicious web shell script.

Original NVD description (English source)

A SQL Injection issue was discovered in SageCRM 7.x before 7.3 SP3. The AP_DocumentUI.asp web resource includes Utilityfuncs.js when the file is opened or viewed. This file crafts a SQL statement to identify the database that is to be in use with the current user's session. The database variable can be populated from the URL, and when supplied non-expected characters, can be manipulated to obtain access to the underlying database. The /CRM/CustomPages/ACCPAC/AP_DocumentUI.asp?SID=<VALID-SID>&database=1';WAITFOR DELAY '0:0:5'-- URI is a Proof of Concept.