SugarCRM versions 9.0.1 and below suffer from multiple reflective cross site scripting vulnerabilities.
a36ef60c0e8d40f91c64cce4c99d669a-------------------------------------------------------------------------
SugarCRM <= 9.0.1 Multiple Reflected Cross-Site Scripting
Vulnerabilities
-------------------------------------------------------------------------
[-] Software Link:
https://www.sugarcrm.com
[-] Affected Versions:
Version 9.0.1 and prior versions, 8.0.3 and prior versions.
[-] Vulnerabilities Description:
1) User input passed through the "form" parameter when handling the
"Popup"
action within the "DataSets" module is not properly sanitized before
being
used to generate HTML output. This can be exploited by malicious users
to
carry out Reflected Cross-Site Scripting (XSS) attacks.
2) User input passed through the "name" parameter when handling the
"Popup"
action within the "DataSets" module is not properly sanitized before
being
used to generate HTML output. This can be exploited by malicious users
to
carry out Reflected Cross-Site Scripting (XSS) attacks.
3) User input passed through the "type" parameter when handling the
"dupcheck"
action within the "Import" module is not properly sanitized before being
used
to generate HTML output. This can be exploited by malicious users to
carry
out Reflected Cross-Site Scripting (XSS) attacks.
4) User input passed through the "message" parameter when handling the
"error"
action within the "Import" module is not properly sanitized before being
used
to generate HTML output. This can be exploited by malicious users to
carry
out Reflected Cross-Site Scripting (XSS) attacks.
5) User input passed through the "direct_step" parameter when handling
the
"WizardNewsletter" action within the "Campaigns" module is not properly
sanitized before being used to generate HTML output. This can be
exploited
by malicious users to carry out Reflected Cross-Site Scripting (XSS)
attacks.
6) User input passed through the "iframe_type" parameter when handling
the
"IframeDropdown" action within the "WorkFlow" module is not properly
sanitized before being used to generate HTML output. This can be
exploited
by malicious users to carry out Reflected Cross-Site Scripting (XSS)
attacks.
[-] Solution:
Upgrade to version 9.0.2, 8.0.4, or later.
[-] Disclosure Timeline:
[07/02/2019] - Vendor notified
[01/10/2019] - Versions 9.0.2 and 8.0.4 released
[10/10/2019] - Publication of this advisory
[-] Credits:
Vulnerabilities discovered by Egidio Romano.
[-] Original Advisory:
http://karmainsecurity.com/KIS-2019-03
[-] Other References:
https://support.sugarcrm.com/Documentation/Sugar_Versions/9.0/Ent/Sugar_9.0.2_Release_Notes