CVE-2020-28328: Malicious File Upload
SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, loggerfilename can refer to an attacker-controlled .php file under the web root.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-28328.
What is the severity of CVE-2020-28328?
The severity of CVE-2020-28328 is critical with a CVSS score of 8.8.
What version of SuiteCRM is affected by CVE-2020-28328?
SuiteCRM version up to and excluding 7.11.17 is affected by CVE-2020-28328.
How can remote code execution be achieved through CVE-2020-28328?
Remote code execution can be achieved through the system settings Log File Name setting, where an attacker-controlled .php file under the web root can be referenced.
Are there any references available for CVE-2020-28328?
Yes, you can refer to the following links for more information: [Link 1](http://packetstormsecurity.com/files/159937/SuiteCRM-7.11.15-Remote-Code-Execution.html), [Link 2](http://packetstormsecurity.com/files/162975/SuiteCRM-Log-File-Remote-Code-Execution.html), [Link 3](http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html).