CVE-2005-4087: High severity SugarCRM Sugar Suite vulnerability

Published Dec 8, 2005

Updated

PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter.

Affected Software

2 affected components

SugarCRM Sugar Suite=3.5

SugarCRM Sugar Suite=4.0_beta

Event History

Dec 8, 2005

CVE Published

11:03 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4087?

CVE-2005-4087 is a high-severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2005-4087?

To fix CVE-2005-4087, upgrade to a patched version of SugarCRM that addresses the remote file inclusion vulnerability.

Which versions of SugarCRM are affected by CVE-2005-4087?

CVE-2005-4087 affects SugarCRM versions 4.0 beta and earlier, including version 3.5.

What type of attack can be executed using CVE-2005-4087?

An attacker can execute arbitrary PHP code on the server by exploiting the remote file inclusion vulnerability in CVE-2005-4087.

Is there a workaround for CVE-2005-4087?

A temporary workaround for CVE-2005-4087 is to disable the specific functionality that allows for URL inclusion until a software update can be applied.