CVE-2023-46816

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
sugarcrm	sugarcrm	>= 12.0.0, < 12.0.4; >= 13.0.0, < 13.0.2.

References

https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/Vendor Advisory
https://support.sugarcrm.com/resources/security/sugarcrm-sa-2023-010/Vendor Advisory

Timeline

Published: Oct 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-468179.8An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized befo CVE-2023-468187.2An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_al CVE-2023-468195.3Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.CVE-2023-46825.5Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468205.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Im CVE-2023-468217.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers all CVE-2023-468226.1Unauth. Reflected Cross-Site Scripting') vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Expor CVE-2023-468237.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image B CVE-2023-468244.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Om Ak Solutions Slick Popup: Contact Form 7 Popup Plugin plugin <= 1.7.14 CVE-2023-46835.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468355.5The current setup of the quarantine page tables assumes that the quarantine domain (dom_io) has been initialized with an address width of DE CVE-2023-468364.7The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe. It was believed that the mi