VYPR
← All advisories
High severity8.8NVD Advisory· Published Oct 27, 2023· Updated Jun 17, 2026

CVE-2023-46816

CVE-2023-46816

Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

11
  • Sugarcrm/Sugarcrm11 versions
    cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*+ 10 more
    • cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:enterprise:*:*:*range: >=12.0.0,<12.0.4
    • cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:sell:*:*:*range: >=12.0.0,<12.0.4
    • cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:serve:*:*:*range: >=12.0.0,<12.0.4
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.0:*:*:*:sell:*:*:*
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.0:*:*:*:serve:*:*:*
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.1:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.1:*:*:*:sell:*:*:*
    • cpe:2.3:a:sugarcrm:sugarcrm:13.0.1:*:*:*:serve:*:*:*
    • (no CPE)
    • (no CPE)range: <12.0.4, <13.0.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.