CVE-2023-46816 — n/a / n/a

Description (CNA)

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/

ADP enrichment

CVE

No English description supplied.

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/

CISA-ADP

No English description supplied.

No references supplied.