CVE-2009-2978: SQL Injection
Published Aug 27, 2009
·Updated
SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Affected Software
36 affected components
SugarCRM SugarCRM=1.5d
SugarCRM SugarCRM=5.0.0
SugarCRM SugarCRM=4.2.1
SugarCRM SugarCRM=4.5.0f
SugarCRM SugarCRM=1.1a
SugarCRM SugarCRM=4.0
SugarCRM SugarCRM=5.2d
SugarCRM SugarCRM=3.5.1
SugarCRM SugarCRM=1.1b
SugarCRM SugarCRM=4.0.1
SugarCRM SugarCRM=4.1
SugarCRM SugarCRM=1.0g
SugarCRM SugarCRM=4.5.1
SugarCRM SugarCRM=4.5.0
SugarCRM SugarCRM<=4.5.1o
SugarCRM SugarCRM=5.2a
SugarCRM SugarCRM=2.0.1c
SugarCRM SugarCRM=1.1e
SugarCRM SugarCRM=2.0.1
SugarCRM SugarCRM=5.2f
SugarCRM SugarCRM<=5.2.0g
SugarCRM SugarCRM=3.5
SugarCRM SugarCRM=5.2c
SugarCRM SugarCRM=1.1c
SugarCRM SugarCRM=1.1f
SugarCRM SugarCRM=1.0
SugarCRM SugarCRM=5.2e
SugarCRM SugarCRM<=5.0.0k
SugarCRM SugarCRM=2.0.1a
SugarCRM SugarCRM=1.1d
SugarCRM SugarCRM=3.0.1
SugarCRM SugarCRM=1.0f
SugarCRM SugarCRM=5.2e
SugarCRM SugarCRM=5.0.0h
SugarCRM SugarCRM=1.1
SugarCRM SugarCRM=4.2
Remediation
Patch Available
Patch Available
Patch Available
Event History
Aug 27, 2009
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2978?
CVE-2009-2978 has a medium severity rating, allowing potential remote exploitation.
2
How do I fix CVE-2009-2978?
To fix CVE-2009-2978, upgrade to SugarCRM versions 4.5.1p, 5.0.0l, or 5.2.0h or later.
3
What versions of SugarCRM are affected by CVE-2009-2978?
CVE-2009-2978 affects SugarCRM versions 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier.
4
What type of vulnerability is CVE-2009-2978?
CVE-2009-2978 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.
5
Can CVE-2009-2978 be exploited remotely?
Yes, CVE-2009-2978 can be exploited remotely, allowing attackers to gain unauthorized access to the database.