CVE-2006-2460: Medium severity sugarcrm sugarcrm vulnerability

Published May 19, 2006

Updated

Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when registerglobals is enabled, does not protect critical variables such as $GLOBALS and $SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter.

Affected Software

4 affected components

SugarCRM SugarCRM=3.5

SugarCRM SugarCRM=4.0

SugarCRM SugarCRM=4.1

SugarCRM SugarCRM=4.2

Event History

May 19, 2006

CVE Published

10:02 AM

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-2460?

CVE-2006-2460 has a high severity due to the potential for remote attacks and exploitation of critical variables.

How do I fix CVE-2006-2460?

To fix CVE-2006-2460, disable register_globals in your PHP configuration and upgrade to a version of SugarCRM that is secure.

What versions of SugarCRM are affected by CVE-2006-2460?

CVE-2006-2460 affects SugarCRM versions 3.5, 4.0, 4.1, and 4.2.

What types of attacks can occur due to CVE-2006-2460?

Exploitation of CVE-2006-2460 can lead to directory traversal and PHP remote file inclusion attacks.

Who is vulnerable to CVE-2006-2460?

Any instance of SugarCRM version 4.2 and earlier with register_globals enabled is vulnerable to CVE-2006-2460.