NVD Vulnerability Detail

CVE-2011-4833

Summary	Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.
Publication Date	Dec. 15, 2011, 12:57 p.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:33 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://secunia.com/advisories/47011	Vendor Advisory
2	http://securitytracker.com/id?1026369	Exploit
3	http://www.osvdb.org/77459	Exploit
4	http://www.securityfocus.com/archive/1/520685/100/0/threaded
5	http://www.sugarcrm.com/crm/support/bugs.html#issue_47800	Exploit
6	http://www.sugarcrm.com/crm/support/bugs.html#issue_47805	Exploit
7	http://www.sugarcrm.com/crm/support/bugs.html#issue_47806	Exploit
8	http://www.sugarcrm.com/crm/support/bugs.html#issue_47839	Exploit
9	https://exchange.xforce.ibmcloud.com/vulnerabilities/71586
10	https://www.htbridge.ch/advisory/sql_injection_in_sugarcrm.html	Exploit
11	http://secunia.com/advisories/47011	Vendor Advisory
12	https://www.htbridge.ch/advisory/sql_injection_in_sugarcrm.html	Exploit
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/71586
14	http://www.sugarcrm.com/crm/support/bugs.html#issue_47839	Exploit
15	http://www.sugarcrm.com/crm/support/bugs.html#issue_47806	Exploit
16	http://www.sugarcrm.com/crm/support/bugs.html#issue_47805	Exploit
17	http://www.sugarcrm.com/crm/support/bugs.html#issue_47800	Exploit
18	http://www.securityfocus.com/archive/1/520685/100/0/threaded
19	http://www.osvdb.org/77459	Exploit
20	http://securitytracker.com/id?1026369	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

SugarCRM の Leads モジュールにおける SQL インジェクションの脆弱性

Title	SugarCRM の Leads モジュールにおける SQL インジェクションの脆弱性
Summary	SugarCRM の Leads モジュールには、SQL インジェクションの脆弱性が存在します。
Possible impacts	第三者により、index.php の get_full_list アクションの (1) where および (2) order パラメータを介して、任意の SQL コマンドを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 15, 2011, midnight
Registration Date	Dec. 19, 2011, 3:08 p.m.
Last Update	Dec. 19, 2011, 3:08 p.m.

Affected System

SugarCRM

SugarCRM 6.1.7 未満の 6.1

SugarCRM 6.2.4 未満の 6.2

SugarCRM 6.3.0RC3 未満の 6.3

SugarCRM 6.4.0beta1 未満の 6.4

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-4833	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4833
National Vulnerability Database (NVD)
2	CVE-2011-4833	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4833

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
SugarCRM
1	issue_47800	http://www.sugarcrm.com/crm/support/bugs.html#issue_47800
2	issue_47805	http://www.sugarcrm.com/crm/support/bugs.html#issue_47805
3	issue_47806	http://www.sugarcrm.com/crm/support/bugs.html#issue_47806
4	issue_47839	http://www.sugarcrm.com/crm/support/bugs.html#issue_47839

Change Log

No	Changed Details	Date of change
0	[2011年12月19日] 掲載	Feb. 17, 2018, 10:37 a.m.